Dekart Private Disk?

[wimpyrbx]

Hi,

I have been searching, but was unable to find anything about it so I'm asking here hoping for some help.

The file format .dpd (Dekart Private Disk) is an encrypted image file using AES 256-bit encryption as far as I can tell.

I am wondering if there is a way to get the password hash for such an image.
The software does support "recover password", but it's too slow for my taste so I'd like to see if there is a way to get the password hash to run it through hashcat.

Anyone know how or if it's possible at all?


PS! I included an attachment, a zip file containing a testfile.dpd for anyone who wants to try this to see if it's possible to find the hash.
PS! Dekart Private Disk password for this testfile.dpd is This1sAt3st if that helps in finding out if the hash can be found in the file.

Cheers for any help on this!

[slyexe]

Sounds very similiar concept to how microsoft documents were encrypted. This software is well aged, just a quick skim thru and the bruteforce FAQ shows using a pentium 4, haha.

The results of Brute Force attack calculations using Pentium 4, 1.6 GHz, 512 cache:

Eitherway, it might be similar in attacking the RC4 key rather than the AES which is how people got access to their microsoft documents. How to go about that would need someone else to chime in and provide some assistance.

This post might have some helpful information.

https://hashcat.net/forum/thread-3665.html

[wimpyrbx]

thanks for the input! unsure how it could be related to same approach as MS documents, but I'll bite and will read the thread you linked!

I'm fairly new at this area so I had no idea if it is/was possible to extract a hash at all from the file.
Could it be possible to monitor memory or something like that when opening a known password on for example the testfile i supplied? To see where it tries to matches/reads hash from? Again, fairly new so excuse my (potential) ignorance or noob questions 

[wimpyrbx]

If anyone has or has had time to play around with my file to find a hash please let me know. Very interested in how this potentially can be solved.