Drive with images e...
 
Notifications
Clear all

Drive with images encrypted with Truecrypt

4 Posts
3 Users
0 Reactions
373 Views
(@bluedragon)
Trusted Member
Joined: 18 years ago
Posts: 60
Topic starter  

A drive containing .e01 images was encrypted with TrueCrypt (Whole drive)

Is there anyway to recover the .e01 images w/o the password?


   
Quote
(@a_kuiper)
Trusted Member
Joined: 16 years ago
Posts: 69
 

Nop


   
ReplyQuote
(@seanmcl)
Honorable Member
Joined: 19 years ago
Posts: 700
 

A drive containing .e01 images was encrypted with TrueCrypt (Whole drive)

Is there anyway to recover the .e01 images w/o the password?

First question Why .e01 images? Second question How did you come by the drive?

The reason that I ask is that this is not a common way to transport drive images execpt in forensics (although it is easy enough for non-foresic people to do). People doing forensics tend to be more methodical and tend to better document what they are doing. You may be able to find the password by looking in the larger environment in which the drive was formatted and the images stored to it.

Unless you have a lot of cycles and a lot of time you are unlikely to crack the password using automated tools. But a more heuristic approach might lead you to the password assuming that you have access to the individual or entity that created the drive in the first place.


   
ReplyQuote
(@a_kuiper)
Trusted Member
Joined: 16 years ago
Posts: 69
 

The question was if it's possible to extract the images without a password.

The answer is no.

If you "crack" the password using a bruteforce-attack and you are extremely lucky you will have the password. Then you can recover the images having the password ).

If you want to scan Truecrypt-passwords it will take a really long time. A dictionary-attack with approx. 16 mio. words takes more than a week on a fast computer-system. The problem is that the passwords are not hashed once but many times.


   
ReplyQuote
Share: