I am trying to find truecrypt header in a dumped, partially damaged backup partition. Password is known.
I could create ~100M chunks of data 512 bytes each. Now I am looking for a possibility to try them all in the fastest possible way. I wrote a multi-threaded script that uses native truecrypt, but it'll take years...
Hashcat seems to be way faster with my test headers, but starting a separate process for each chunk is inefficient (and will again take years). Hashcat doesn't accept directories of files as a source, nor could I find a way to combine multiple binary hashes in single source file.
John the Ripper has a small script that hexifies headers. I could use it to store my TC header as a hash string, but it seems hashcat doesn't accept it for the mode 6233 which I need. And John the Ripper itself doesn't seem to support cascaded TC algorithms, one of which was used in my case (mode 6233 successfully decodes test header of similar container, but john the ripper fails).
I'd be glad for any ideas how can I proceed...
I could create ~100M chunks of data 512 bytes each. Now I am looking for a possibility to try them all in the fastest possible way. I wrote a multi-threaded script that uses native truecrypt, but it'll take years...
Hashcat seems to be way faster with my test headers, but starting a separate process for each chunk is inefficient (and will again take years). Hashcat doesn't accept directories of files as a source, nor could I find a way to combine multiple binary hashes in single source file.
John the Ripper has a small script that hexifies headers. I could use it to store my TC header as a hash string, but it seems hashcat doesn't accept it for the mode 6233 which I need. And John the Ripper itself doesn't seem to support cascaded TC algorithms, one of which was used in my case (mode 6233 successfully decodes test header of similar container, but john the ripper fails).
I'd be glad for any ideas how can I proceed...