Noob Extracting VeraCrypt MBR
#4
Well, that's very different, both the size of the binary data and they don't even use an offset (the skip parameter).
Of course if you skip 31744 from the start you won't find the "Truecrypt΅ header which is at about offset 0x0 (the very beginning).
It's also not very good to mix-up the steps involved by hashcat with the ones of a different cracking tool (if you do not know exactly what these dd command do, including skip etc).

... to make it very clear, the 512 bytes hashcat needs, do not contain a Veracrypt/Truecrypt string, other tools might need much more data as input (and within this larger amount of data there might also be more headers/string). Don't follow the steps from a different password recovery tool and use that extracted data as input for hashcat because it might not be what hashcat expects. Just stick to the FAQ of hashcat!

The technical explanation is: the tool you linked to expects 64*bs (block size - bs - defaults to 512 bytes) = 32768 bytes from the start, while hashcat only expects the data needed (i.e. the 512 bytes after the 62*bs (512 bytes) = 31744 bytes). As you can see, both tools at the end have the 512 bytes needed (the other tool probably just ignores the remaining bytes of data you give to it).


Messages In This Thread
RE: Noob Extracting VeraCrypt MBR - by philsmd - 01-26-2017, 09:34 AM
RE: Noob Extracting VeraCrypt MBR - by philsmd - 01-27-2017, 09:36 AM
RE: Noob Extracting VeraCrypt MBR - by philsmd - 01-27-2017, 10:33 AM
RE: Noob Extracting VeraCrypt MBR - by philsmd - 01-27-2017, 10:55 AM
RE: Noob Extracting VeraCrypt MBR - by takitano - 01-27-2017, 12:16 PM
RE: Noob Extracting VeraCrypt MBR - by kiara - 01-27-2017, 12:52 PM
RE: Noob Extracting VeraCrypt MBR - by atom - 01-27-2017, 11:53 PM
RE: Noob Extracting VeraCrypt MBR - by philsmd - 01-28-2017, 01:50 PM
RE: Noob Extracting VeraCrypt MBR - by atom - 01-31-2017, 10:22 AM
RE: Noob Extracting VeraCrypt MBR - by atom - 02-03-2017, 01:17 PM