07-26-2019, 04:27 AM
The FAQ over here https://hashcat.net/wiki/doku.php?id=fre...pt_volumes clearly says that you need to extract the last 512 bytes
therefore you got very lucky that hashcat prevented you from cracking the wrong bytes (because it has a sanity check that makes sure the data is sufficiently random == entropy check)
Quote:in case of a physical disk you need to copy the last 512 bytes of the *first logical volume*.
therefore you got very lucky that hashcat prevented you from cracking the wrong bytes (because it has a sanity check that makes sure the data is sufficiently random == entropy check)