Veracrypt Non-bootable drive

[noobie90]

Hello all,

Ive lost the password to a veracrypt encrypted drive, but do have a list of passwords of which Im 99% sure the password is on. 

Ive tried cracking the volume directly, but obviously failed.

So I decided to do a test run: I encrypted another USB drive with one of the passwords on the list.
Ive extracted the first 512 bytes using DD for windows, and even the last 512 bytes since the FAQ is not really clear on which one to use. When both of those failed, I even DDd the whole drive and tried that as input for Hashcat, but it never cracks the volume...so I thought: maybe the hash is wrong? So I wrote a script that tries all the possible veracrypt hashes (-m 13711, 13712, 13713 etc etc), but it still always exhausts!

I must be doing something wrong when extracting the hash I guess? 
The command I used to extract the hash is 

ddrelease64.exe if=\\.\Volume{XXXXXX} of=veracrypt-target.img bs=512 count=1

(for the last sector, similar, but of course used skip to get only the last 512 bytes).

My hashcat command is

hashcat -a 0 -m 13711 test.img list.txt

Can anybody help me? What am I doing wrong?

Many, many thanks for any answers!!

BTW cracking one of the example hashes on the website works

[philsmd]

Did you read this:
https://hashcat.net/wiki/doku.php?id=fre...pt_volumes
?

is this a physical disk ? how many volumdes/partitions etc?

Maybe you are using the wrong case (encrypted file vs physical disk etc) in that list of different offsets.

[noobie90]

Many thanks for your reply! I did read that. Both my test- and actual drive or USB drives, so physical disk, non bootable. They have 1 volume and 1 partition.

According to the link you sent, I think I need to copy the the last 512 bytes of the *first logical volume*. Since I only have one volume, that should just be the last 512 bytes of the disk, correct? That is what I did.
I got confused because a lot of posts here on the forum (even ones about USB drives) used the first 512 bytes, so that is why I just tried both.

My problem is a lot like https://hashcat.net/forum/thread-5833.html, only that guy managed to crack his partition by DD the whole disk (which I did as well because of that post, but didnt work either!)

[philsmd]

there could be many problems here.

maybe you do not test the correct password / dictionary file, please try with a wordlist ONLY containing the password.

Did you test with that dcfldd windows binary ? are the e.g. sha256 checksums of the 512 bytes the same ? (compare the output of the dcfldd tool with your extracted data that you've tested already)

You also need to know that dcfldd if=/dev/sdb1 .... means that the offset is from the partition, not the "/dev/sdb" drive itself. That means that the guy over there copied the first 512 bytes of the partition, not the first 512 bytes of the hard disk (there is probably a partition table, mbr/gpt at the start of the volume/disk)....

There can be many small errors like this that can lead to a false negative.

You could also try to make a further example with a very easy password again, just to make sure that you did enter the password correctly (and performed also all other steps correctly) when creating the tests.

It's actually very good that you are trying to crack an example for which you know the password, otherwise you would waste a lot of time/resource on a non-crackable "hash".... now you just need to figure out what exactly you did wrong... my guess is that it's the dd command that still has the wrong offset (partition vs volume etc) or the password/command is wrong