04-05-2024, 07:12 PM
(04-05-2024, 02:18 PM)zerozero Wrote: Client asked me if i can crack his drive(he remembers most of the password, but forgot few characters), which is encrypted with veracrypt. It asks for a password and PIM(pim wasnt set, so its just the default value) upon booting.
Im having trouble understanding on how can i extract the hash from this type of encryption with dd.
Veracrypt + boot mode + hidden (im not sure which hash algo he used, i believe its the default one)
I tried this
dd if=\\?\Device\Harddisk1\Partition0 of=hash.tc bs=1 skip=65536 count=512
and it said "Error reading file: 87 The parameter is incorrect"
So my question is where am i failing at?
I tried following this, but im not sure if im approaching this correctly
https://hashcat.net/wiki/doku.php?id=fre...pt_volumes
So just to be clear, it's a system drive? It's bootable? In that case use veracrypt2hashcat.py
It's located in the tools folder of hashcat 6.2.6
It can be run like:
veracrypt2hashcat.py --offset=bootable path-to-drive
The algo is found in a file called dcsprop located in the EFI folder of the boot partition.
Then use mode 294xx to attack with.
If you want to stick with dd, I think your path is incorrect. Is it on windows? Then it's \\.\physicaldriveX