TrueCrypt Boot 7.1a Hash Extraction

[timi2shoes]

Ok, so I found the correct byte offset. Starting at the first of the drive wrote a program that ran through and tested 512 byte chunks at a time. The hash succeeded at Sector 62 byte offest 31744.

Thanks to philsmd for pointing me where to start searching.

So it seems, the volume header is stored in the last sector of the first track of the encrypted system drive.