(01-24-2023, 04:17 PM)b8vr Wrote: You can't add a file path to --veracrypt-keyfiles. I talked with @atom about this. And as I remember, if you used more than one keyfile when encrypting your volume, you're probably f*cked. I'm pretty sure that the way it works with --veracrypt-keyfiles, is that it tries each of the given files, but none if them in combination.
I've run some more tests, and as it turns out, my original HASHCAT command works, even with 100 files.
My problem was with DD for Windows. The correct command should have been:
dd if=\\?\device\Harddisk7\Partition1 of=..\test.dat.vc skip=128 bs=512 count=1
When I first started experimenting with containers, I used "bs=1 skip=65536 count=512" and it worked fine (this is actually in the Hashcat FAQs). However, I had to transpose the BS and SKIP values with partitions to make them work. Apparently, SKIP multiplies the BS value to derive the actual number of bytes skipped. Thus, the original, incorrect command was skipping 33554432 bytes (i.e., 65536 x 512). To make it skip 65536 bytes, I had to divide that by the BS value of 512 to get 128. Then it correctly skipped 65536 and got the correct volume header, for which the above HASHCAT command worked just fine.
I figured I should add my discovery here in case it helps someone in the future.