Crack old TrueCrypt backup without knowing encryption
#3
(04-24-2022, 09:17 PM)ApoY2k Wrote: I found an old backup recently, which is comprised of a TrueCrypt Archive, split in 7 parts of 600MB each.

I don't know which encryption was used and no clue about the password. However, I'd like to at least try to crack it.

I read through the wiki a bit but it appears the assumption is always present that one has to know what encryption was used before attempting to use hashcat.

However, what should I do if that is not known?

When cracking TrueCrypt containers like that, which are not bootable, you have several modes available in hashcat. But you can actually focus on just three. If you run hashcat in mode 6213, it will also cover 6211 and 6212. This is true for all the TrueCrypt (and VeraCrypt) modes. So you can focus on 6213, 6223 and 6233.

I can't remember which is default mode, but I think it's 6211 or 6221, so you could also just focus on those.
Reply


Messages In This Thread
RE: Crack old TrueCrypt backup without knowing encryption - by b8vr - 04-25-2022, 12:37 PM