Recover Veracrypt Password

[kasuky1590]

Hi Everyone,

I know that there are some similar questions here, but I need to be sure that I am doing things right.

My problem is that I encrypted my USB driver using Veracrypt with a password and a PIM.
I wrote them on a piece of paper but unfortunately, I lost the paper.
I remember the PIM but it was impossible to remember the password completely.
Actually, I am not sure of the length of the password.

First of all, I extracted the encrypted key (the first 512 bytes) using the following command

Code:

dd if=/dev/sdg1 of=encrypted/target_hash.tc bs=512 count=1

And I have been using the following command to get the password

Code:

sudo hashcat -a 3 -w 1 -m 13721 target_hash.tc [pattern] --force --veracrypt-pim=[PIM]

This has taken a lot of time, but I am not sure if the parameters in the command above are right.

Also, I would like to know if there is a way to get a copy of the USB drive. If I was not able to get the password, I would like to get a copy to use at another time.

Thanks.

[marc1n]

delete --force in command line is not recommended, you may get erroneous results.

[Snoopy]

to get a complete image of your usb stick, assuming it is still sdg[1], the 1 is just the first partition of your usb device

when susing older versions of dd you have to remove status=progress (this helps to see how much data is already copied)

dd if=/dev/sdg of=fullusb.dd bs=512 status=progress

this will make a full 1:1 copy of your usb stick, image size = usb-stick size, so 4gb usb will result in 4gb dd image

[JimYu]

delete --force
and use --veracrypt-pim-start [PIM] --veracrypt-pim-stop [PIM]