Recovering an encrypted file

[philsmd]

hashcat supports veracrypt with the hash modes

Code:

137XY | VeraCrypt
     X  | 1 = PBKDF2-HMAC-RIPEMD160
     X  | 2 = PBKDF2-HMAC-SHA512
     X  | 3 = PBKDF2-HMAC-Whirlpool
     X  | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode
     X  | 5 = PBKDF2-HMAC-SHA256
     X  | 6 = PBKDF2-HMAC-SHA256 + boot-mode
      Y | 1 = XTS  512 bit pure AES
      Y | 1 = XTS  512 bit pure Serpent
      Y | 1 = XTS  512 bit pure Twofish
      Y | 2 = XTS 1024 bit pure AES
      Y | 2 = XTS 1024 bit pure Serpent
      Y | 2 = XTS 1024 bit pure Twofish
      Y | 2 = XTS 1024 bit cascaded AES-Twofish
      Y | 2 = XTS 1024 bit cascaded Serpent-AES
      Y | 2 = XTS 1024 bit cascaded Twofish-Serpent
      Y | 3 = XTS 1536 bit all

you could use the modes 13713, 13723, 13733, 13753 (for non-boot disks) if you really have no clue about the hashing used.

Both truecrypt and veracrypt as far as I know do not really have a header (meta information), LUKS, for instance, instead has a header with all this information.

here are example hashes: https://hashcat.net/wiki/doku.php?id=example_hashes
and here is an explanation on how to extract the data: https://hashcat.net/wiki/doku.php?id=fre...pt_volumes

I would recommend that you try to create similar volumes/disks and crack them as a test before cracking the target data (just to be sure that you are using the correct steps).