Veracrypt question

[kiara]

hi every1

i was looking at hash example https://hashcat.net/wiki/doku.php?id=example_hashes
and veracrypt wasnt there.

can some one explain on how to get the hash/ *tc*(for veracryptfile..) file from a container\full disk encryption?

for truecrypt, the location was the first 512 bytes of the hdd disk sector.

i dont know how if it is the same case of veracrypt.

would be great if some one could please clarified this. thanks!

[philsmd]

Yeah, it's exactly the same procedure for veracrypt (like it is for truecrypt "hashes", also see https://hashcat.net/wiki/frequently_aske...pt_volumes)

And yes, you are right, the sample veracrypt "hash(es)" are missing from the example hashes wiki page... it would be very nice if someone could provide those with password "hashcat" (shouldn't be impossible of course, but a little bit of work since there are several algorithms selectable for veracrypt too).

[kiara]

i will found time and i will try to do it myself.

mean while, i have an encrypted hdd which i dont know what program were being use to encrypt it, i thought maybe it was veracrypt but from what u are saying it is not.

any idea how could like figure out which program were used , like reading specify sectors.

[neo79]

usualy the first sector should tell you, I cant remember how I did it but I guess there is some tool to read from sector 0, it showed up for drivecrypt.

[kiara]

im running linux, their is dd to watch the sectors.

the question is which sector should i look for to find it

[bigblacknose]

im running linux, their is dd to watch the sectors.

the question is which sector should i look for to find it

Isn't it just like something like this:
dd if=disk.dd of=disk.hash skip=62 bs=512 count=1 ?

If it is the last sector of the first track as in TC?


// BigBlackNose

[royce]

Follow-up - there are at least now non-boot VeraCrypt examples on the example hashes wiki page.

https://hashcat.net/wiki/doku.php?id=example_hashes