I am trying to recover the truecrypt v6.1a password from memory dump on Ubuntu. I found very good paper by
You tried the tools linked to in this paper? http//
You might have to try looking through the source code for those tools and see how they are finding the password and then assume that in 6.1 the password may be stored slightly differently. Such as data around the password that identified or pointed to a truecrypt password is now different.
Also, if the truecrypt password is truly stored plaintext then you should be able to run a string search for it against the RAM dump. Maybe you could compare the area where the string is stored in the 5.1a dump to the 6.1 dump (and the data around that area). I don't know if truecrypt has a persistent location that it stores the password in or if it just drops it into RAM wherever with some sort of identifier or what.
When I get some time I will look at this too as I've been wanting to try it.