02-08-2021, 05:08 PM
(02-08-2021, 05:04 PM)Karamba Wrote: I do not understand what you are trying to do, since you have knowledge of the password.
You want to test if Hashcat finds the known pwd? If yes, follow these steps: https://hashcat.net/wiki/doku.php?id=fre...pt_volumes
You do not need the JtR script. Hashcat accepts a file/container as input. (Out of convenience, one cuts out the correct 512 bytes from the file/container/partition; that is enough for Hashcat to work on)
As I mentioned above I have a damaged backup dump where the filesystem is in chunks. Inside that dump there is a 200GB truecrypt file container. Since there are just a few files besides it in the dump, I could roughly identify the beginning and the end of the file (corresponding chunks), but not exactly the needed 512 bytes (either of primary or backup TC header). My intention is to check a few millions of 512 chunks with the password I know to find the correct position of the file start (or, well end in case of backup header).