Cracking encrypted veracrypt partition from windows laptop
#5
jfyi

when using normal procedure of system encrypting with veracrypt wizard, the second screen tells, that only the windows partiton will be encrypted WITHOUT using the specific verycrypt bootloader, so i can only guess what VC is really doing, but given this, mode 13761 (+boot) is maybe really the wrong mode

regarding your veracrypt-hash.jpg
the data you should get after dd should be binary, without any real string inside, so there seems to be a problem there

anyway, i find this "old" output for --help, regarding vc more handy, as you can see Y 2 is alway 1024 bit and 1 only 512, 

so you could try -mode 13762 and see if this works for your veracrypthash.txt

137XY | VeraCrypt                              | Full-Disk Encryption (FDE)
  X  | 1 = PBKDF2-HMAC-RIPEMD160                  | Full-Disk Encryption (FDE)
  X  | 2 = PBKDF2-HMAC-SHA512                    | Full-Disk Encryption (FDE)
  X  | 3 = PBKDF2-HMAC-Whirlpool                | Full-Disk Encryption (FDE)
  X  | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode    | Full-Disk Encryption (FDE)
  X  | 5 = PBKDF2-HMAC-SHA256                    | Full-Disk Encryption (FDE)
  X  | 6 = PBKDF2-HMAC-SHA256 + boot-mode        | Full-Disk Encryption (FDE)
  X  | 7 = PBKDF2-HMAC-Streebog-512              | Full-Disk Encryption (FDE)
  Y | 1 = XTS  512 bit pure AES                  | Full-Disk Encryption (FDE)
  Y | 1 = XTS  512 bit pure Serpent              | Full-Disk Encryption (FDE)
  Y | 1 = XTS  512 bit pure Twofish              | Full-Disk Encryption (FDE)
  Y | 1 = XTS  512 bit pure Camellia            | Full-Disk Encryption (FDE)
  Y | 1 = XTS  512 bit pure Kuznyechik          | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit pure AES                  | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit pure Serpent              | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit pure Twofish              | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit pure Camellia            | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit pure Kuznyechik                  | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded AES-Twofish            | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Camellia-Kuznyechik    | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Camellia-Serpent        | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Kuznyechik-AES          | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Kuznyechik-Twofish      | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Serpent-AES            | Full-Disk Encryption (FDE)
  Y | 2 = XTS 1024 bit cascaded Twofish-Serpent        | Full-Disk Encryption (FDE)
  Y | 3 = XTS 1536 bit all                      | Full-Disk Encryption (FDE)
14600 | LUKS                                    | Full-Disk Encryption (FDE)
16700 | FileVault 2                              | Full-Disk Encryption (FDE)
18300 | Apple File System (APFS)                | Full-Disk Encryption (FDE)
Reply


Messages In This Thread
RE: Cracking encrypted veracrypt partition from windows laptop - by Snoopy - 01-05-2022, 07:34 PM