±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26959
Visitors: 74

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Detecting Truecrypt Volume in EnCase

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 11:46 am

I've been given a university assingment to extract a series of .jpg files from an image. We have been told there is a Truecrypt hidden somewhere on the image.

I'm fairly new to EnCase 6 and I was wondering if somebody could point in the right direction.

Thanks thanks,
iDan  

iDan
Newbie
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 12:19 pm

What have you tried?

The forums aren't really here to do your homework for you, so if you want help you are going to have to give us more info than that.  

twjolson
Senior Member
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 12:47 pm

- iDan

I'm fairly new to EnCase 6...


I can help you quite easily, but the instructions won't have anything to do with EnCase...so it might not be that easy for you.  

keydet89
Senior Member
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 5:02 pm

Entropy, file length, sector boundary  

jhup
Senior Member
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 5:04 pm

...or check the Registry for access to an encrypted volume, map that to the user and date/time, and then compare that to documents/files opened...  

keydet89
Senior Member
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 5:22 pm

You also need to consider if it is a Truecrypt file within the file system, or a volume outside of visible file systems.
For example do the visible partitions on the disk actually fill up the disk?

Another technique is to check file signatures for all the files on the disk. For example you might find a file with the file name xxxxx.jpg, but the internals of the file aren't a JPG at all.

As per keydet89's comment, I don't know how to do this in EnCase as I don't use EnCase.  

Passmark
Senior Member
 
 
  

Re: Detecting Truecrypt Volume in EnCase

Post Posted: Thu Jan 24, 2013 5:59 pm

- iDan
I've been given a university assingment to extract a series of .jpg files from an image. We have been told there is a Truecrypt hidden somewhere on the image.


What OS is the image file? Knowing this will help in looking for information about Truecrypt.  

section2600
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next