02-28-2018, 07:58 AM
(02-27-2018, 03:39 PM)undeath Wrote: Not sure why you tried skip=1993276928. According to the FAQ you need the first 512 bytes of /dev/sdc1.According to https://hashcat.net/wiki/doku.php?id=fre...pt_volumes
Is your password 0123456789 or 123456789? Are you using a hidden volume?
Rule 3.II:
Quote:in case of a physical disk you need to copy the last 512 bytes of the *first logical volume*.
First 512 bytes would be Rule 3.I for a single TC file. Which is not what I have or am I wrong?
Also tried both without any success.
password is 123456789 no leading 0
I used "Standard TrueCrypt volume", although the truecrypt2john.py script somehow got an hash for a hidden volume, which is also the hash, that resulted in the right password with John the Ripper.