+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: TrueCrypt Hidden (/thread-9451.html)
TrueCrypt Hidden - kiwirob - 08-13-2020
So I have a TrueCrypt Hidden Partition I can't remember the password for.
The unhidden (first/primary) partition can successfully found using mode 6213
"/Users/xxxxx/Downloads/filename.tc:thisisthepassword
Session..........: hashcat
Status...........: Cracked
Hash.Name........: TrueCrypt RIPEMD160 + XTS 1536 bit
Hash.Target......: /Users/xxxxx/Downloads/filename.tc
Time.Started.....: Thu Aug 13 18:20:38 2020 (0 secs)
Time.Estimated...: Thu Aug 13 18:20:38 2020 (0 secs)
Guess.Mask.......: thisisthepassword [50]
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........: 5 H/s (90.39ms) @ Accel:24 Loops:1024 Thr:64 Vec:1
Recovered........: 1/1 (100.00%) Digests
Progress.........: 1/1 (100.00%)
Rejected.........: 0/1 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:1024-1999
Will the hidden partition also be mode 6213 or could it be one of the other TrueCrypt modes?
6211 | TrueCrypt RIPEMD160 + XTS 512 bit | Full-Disk Encryption (FDE)
6212 | TrueCrypt RIPEMD160 + XTS 1024 bit | Full-Disk Encryption (FDE)
6213 | TrueCrypt RIPEMD160 + XTS 1536 bit | Full-Disk Encryption (FDE)
6241 | TrueCrypt RIPEMD160 + XTS 512 bit + boot-mode | Full-Disk Encryption (FDE)
6242 | TrueCrypt RIPEMD160 + XTS 1024 bit + boot-mode | Full-Disk Encryption (FDE)
6243 | TrueCrypt RIPEMD160 + XTS 1536 bit + boot-mode | Full-Disk Encryption (FDE)
6221 | TrueCrypt SHA512 + XTS 512 bit | Full-Disk Encryption (FDE)
6222 | TrueCrypt SHA512 + XTS 1024 bit | Full-Disk Encryption (FDE)
6223 | TrueCrypt SHA512 + XTS 1536 bit | Full-Disk Encryption (FDE)
6231 | TrueCrypt Whirlpool + XTS 512 bit | Full-Disk Encryption (FDE)
6232 | TrueCrypt Whirlpool + XTS 1024 bit | Full-Disk Encryption (FDE)
6233 | TrueCrypt Whirlpool + XTS 1536 bit | Full-Disk Encryption (FDE)
RE: TrueCrypt Hidden - NoReply - 08-13-2020
Depends on what type of algo you specified when you created the volume. If you did not touch it like most people, the answer is yes, it is also mode 6213. The extraction of the necessary data is different though. See https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes