Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I don't remember if I have create a (not-hidden) TrueCrypt volume in one of my partitions and copied some files there. I've tried my usual password but it does not work. So, before reformatting such partition, I wish to know if there is a method to detect the presence of a TC volume in such partition.

I already know TCHunt but it works only for files and folders, not partitions.

share|improve this question
    
Recently a friend had a HD from his brother-in-law and it was described as "corrupted." We wound up mounting it using a linux VM and looking at the raw partition for clues. It actually said "truecrypt" in plain text... –  horatio May 8 '12 at 18:24
    
@horatio The contents of any TrueCrypt volume (either a file-based volume or a partition-based one) are always just random bits. There is no magic number or keyword anywhere in it that identifies it as a TrueCrypt volume. If you saw the word "truecrypt" in the raw partition data, it was because it was stored in an ordinary file that was not encrypted in any way. –  Fran May 9 '12 at 14:51
    
Nice assertion. The fact is, the owner tracked down the password and unencrypted the truecrypt volume. –  horatio May 10 '12 at 13:40

1 Answer 1

up vote 0 down vote accepted

You could copy the raw partition data into a file and run TCHunt on that file. On Linux, you can copy a partition to a file as user root with this command (assuming the partition you are copying is not mounted):

dd if=/dev/sda3 of=/tmp/myfile bs=512

Here, /dev/sda3 is the partition being copied, and /tmp/myfile is the file that will contain the copy.

The same can be done for Windows, but I don't know how. I would just boot the Windows box into a Linux live CD, mount a partition to hold the copy, and use the above dd command to read the (possibly) encrypted partition.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.