up vote 1 down vote favorite
share [g+] share [fb]

I don't remember if I have create a (not-hidden) TrueCrypt volume in one of my partitions and copied some files there. I've tried my usual password but it does not work. So, before reformatting such partition, I wish to know if there is a method to detect the presence of a TC volume in such partition.

I already know TCHunt but it works only for files and folders, not partitions.

link|improve this question
50% accept rate
Recently a friend had a HD from his brother-in-law and it was described as "corrupted." We wound up mounting it using a linux VM and looking at the raw partition for clues. It actually said "truecrypt" in plain text... – horatio May 8 at 18:24
@horatio The contents of any TrueCrypt volume (either a file-based volume or a partition-based one) are always just random bits. There is no magic number or keyword anywhere in it that identifies it as a TrueCrypt volume. If you saw the word "truecrypt" in the raw partition data, it was because it was stored in an ordinary file that was not encrypted in any way. – Fran May 9 at 14:51
Nice assertion. The fact is, the owner tracked down the password and unencrypted the truecrypt volume. – horatio May 10 at 13:40
feedback

1 Answer

up vote 0 down vote accepted

You could copy the raw partition data into a file and run TCHunt on that file. On Linux, you can copy a partition to a file as user root with this command (assuming the partition you are copying is not mounted):

dd if=/dev/sda3 of=/tmp/myfile bs=512

Here, /dev/sda3 is the partition being copied, and /tmp/myfile is the file that will contain the copy.

The same can be done for Windows, but I don't know how. I would just boot the Windows box into a Linux live CD, mount a partition to hold the copy, and use the above dd command to read the (possibly) encrypted partition.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.