I have a DD image of a truecrypt encrypted HDD. I need to mount the encrypted image to a drive letter – in Windows.
FTK Imager - no dice - device does not show up in Truecrypt device list
OSForensics - no dice - device does not show up in Truecrypt device list
Any ideas?
Encase?
Arsenal Image Mounter is a free physical disk emulator, this should work.
If you cant mount it as a physical disk you could probably copy out the partition an mount it as an encrypted container rather than a disk.
Is there a partition table followed by 0x55AA in the first sector of the dd image? Is there any plain text to indicate that it is a truecrypt bootable system encrypted drive?
If it is a bootable system encrypted drive mounting will not be simple. If they have simply encrypted the whole disk of a 2nd drive or external drive then mounting would just be as simple as pointing truecrypt at the dd file to mount.
Here is a crazy idea Use truecrypt or veracrypt (i suspect it's backwards compatible).
If you are trying to get an image of the decrypted data and have the password or the keys have a look at my github project https://
You should be able to get an image of the decrypted data without needing TrueCrypt or mounting the image.
The image.py example is what you're after.
Adam