03-27-2016, 11:53 AM
Hi,
This is the situation:
I was attacking a TC system disk (boot mode) with hashcat.
After som days hashcat actually found a password that made sense to previous passwords that I had seen.
To confirm (and a simple way to decrypt from E01) I launched Passware against the same TC disk.
No success. Passware didn't find the same password (didn't find any password).
I mounted and booted the TC disk in VMware but unfortunate I can't unlock the disk with the password that hashcat found. I'm aware the TC/boot defaults to US Ascii keyboard layout and if there are special characters (which is the case) in the password, but I have tried this in a lot of various way and still it is not possible to unlock the disk.
I also have tried mounting the disk in *nix in different ways, but no success.
What is happening here? Do you have any thoughts? Passware says that the password that hashcat has found is wrong. I repeated the process of extracting the TC hash and tried different of hashcat installations (also the beta), and every time hashcat is able to find the same password.
Thanks for your thoughts. I'll be happy to share further information with someone involved in development.
/ bigblacknose
This is the situation:
I was attacking a TC system disk (boot mode) with hashcat.
After som days hashcat actually found a password that made sense to previous passwords that I had seen.
To confirm (and a simple way to decrypt from E01) I launched Passware against the same TC disk.
No success. Passware didn't find the same password (didn't find any password).
I mounted and booted the TC disk in VMware but unfortunate I can't unlock the disk with the password that hashcat found. I'm aware the TC/boot defaults to US Ascii keyboard layout and if there are special characters (which is the case) in the password, but I have tried this in a lot of various way and still it is not possible to unlock the disk.
I also have tried mounting the disk in *nix in different ways, but no success.
What is happening here? Do you have any thoughts? Passware says that the password that hashcat has found is wrong. I repeated the process of extracting the TC hash and tried different of hashcat installations (also the beta), and every time hashcat is able to find the same password.
Thanks for your thoughts. I'll be happy to share further information with someone involved in development.
/ bigblacknose