I've been given a university assingment to extract a series of .jpg files from an image. We have been told there is a Truecrypt hidden somewhere on the image.

I'm fairly new to EnCase 6 and I was wondering if somebody could point in the right direction.

Thanks thanks,
iDan  

What have you tried?

The forums aren't really here to do your homework for you, so if you want help you are going to have to give us more info than that.  

- iDan

I'm fairly new to EnCase 6...

I can help you quite easily, but the instructions won't have anything to do with EnCase...so it might not be that easy for you.  

Entropy, file length, sector boundary  

...or check the Registry for access to an encrypted volume, map that to the user and date/time, and then compare that to documents/files opened...  

You also need to consider if it is a Truecrypt file within the file system, or a volume outside of visible file systems.
For example do the visible partitions on the disk actually fill up the disk?

Another technique is to check file signatures for all the files on the disk. For example you might find a file with the file name xxxxx.jpg, but the internals of the file aren't a JPG at all.

As per keydet89's comment, I don't know how to do this in EnCase as I don't use EnCase.  

- iDan

I've been given a university assingment to extract a series of .jpg files from an image. We have been told there is a Truecrypt hidden somewhere on the image.

What OS is the image file? Knowing this will help in looking for information about Truecrypt.