±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35997
New Yesterday: 0 Visitors: 172

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Find data from Truecrypt with Volatility

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

banderas20
Member
 

Find data from Truecrypt with Volatility

Post Posted: Jul 04, 19 18:15

Hello!

The thing is, I have a memory dump in which appears the process "Truecrypt.exe" and a mounted volume, and I want to find the key.

I issue:

volatility truecryptmaster
volatility truecryptsummary
volatility truecryptpassphrase


The 2 firsts give me results, but the last one yields no results. I expect to find the key that must be stored somewhere in memory.

¿How can I achieve that?

Thanks!  
 
  

athulin
Senior Member
 

Re: Find data from Truecrypt with Volatility

Post Posted: Jul 05, 19 05:05

- banderas20
The 2 firsts give me results, but the last one yields no results. I expect to find the key that must be stored somewhere in memory.

¿How can I achieve that?


Passphrase caching is, as far as I know, disabled by default. You have to enable it first.  
 
  

banderas20
Member
 

Re: Find data from Truecrypt with Volatility

Post Posted: Jul 05, 19 13:30

- athulin
- banderas20
The 2 firsts give me results, but the last one yields no results. I expect to find the key that must be stored somewhere in memory.

¿How can I achieve that?


Passphrase caching is, as far as I know, disabled by default. You have to enable it first.


Ok. So there's nothing I can do now, then? Can I look for another cached files related with that crypted drive?

Thanks!  
 

Page 1 of 1