09-06-2016, 01:48 AM
(09-05-2016, 09:09 PM)Magier Wrote:(09-05-2016, 09:32 AM)atom Wrote: The use of the last 512 byte goes back to the mbr placement on the first in case of a booting partition. Not sure how it is with a non booting partition. It could be the first 512 byte because there's no mbr. You should simply try out. Create such a disk and crack your own disc. It will be either the first or the last 512 byte.
Thanks. That is what i have tried out.
Code:dcfldd if=/dev/sdb1 of=HashcatTest_sdb1_First.dd bs=512 count=1 conv=noerror,sync status=progress
dcfldd if=/dev/sdb1 of=HashcatTest_sdb1_Last.dd bs=512 skip=124999 conv=noerror,sync status=progress
dcfldd if=/dev/sdb1 of=HashcatTest_sdb1_All.dd bs=512 conv=noerror,sync status=progress
Only in HashcatTest_sdb1_All.dd i found the Passwort.
congratz!