Pass for Veracrypt file container, algorithm Twofish-Serpent
#2
1. dd (dd.exe) can be used on windows too to extract the bytes
2. you are probably confusing the data length that needs to be decrypted to verify if the password was correct with the key length ("generated" by the key derivation function that uses the password as an input). Furthermore, we are speaking about 1024 bit keys vs 512 bytes of data (= 512 * 8 = 4096 bits), i.e. bits != bytes
3. as you can see from the --help output, hashcat supports various *different* hashing algorithms for veracrypt and truecrypt. Only the "hash extraction" between truecrypt and veracrypt are similar, but the algorithms are not (otherwise there wouldn't be that many different hash modes after all).

btw: I highly recommend that you should create a similar volume/partition with same parameters and experiment on this data (extracting the bytes, recovering the password etc)... it is too easy to make mistakes and therefore you should test with a similar setup and only if you are able to recover the password of that volume for which you know the password, you should move on to the actual partition/volume that you want to crack. This might help you to avoid spending hours cracking a "hash" that is uncrackable just because you didn't extract the data correctly or used the wrong hashcat arguments etc (in general, if the test works, the actual "hash" should crack too if the correct password is in the password candidates list)


Messages In This Thread
RE: Pass for Veracrypt file container, algorithm Twofish-Serpent - by philsmd - 06-18-2018, 07:57 PM