Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't remember if I have create a (not-hidden) TrueCrypt volume in one of my partitions and copied some files there. I've tried my usual password but it does not work. So, before reformatting such partition, I wish to know if there is a method to detect the presence of a TC volume in such partition.

I already know TCHunt but it works only for files and folders, not partitions.

share|improve this question
Recently a friend had a HD from his brother-in-law and it was described as "corrupted." We wound up mounting it using a linux VM and looking at the raw partition for clues. It actually said "truecrypt" in plain text... – horatio May 8 '12 at 18:24
@horatio The contents of any TrueCrypt volume (either a file-based volume or a partition-based one) are always just random bits. There is no magic number or keyword anywhere in it that identifies it as a TrueCrypt volume. If you saw the word "truecrypt" in the raw partition data, it was because it was stored in an ordinary file that was not encrypted in any way. – Fran May 9 '12 at 14:51
Nice assertion. The fact is, the owner tracked down the password and unencrypted the truecrypt volume. – horatio May 10 '12 at 13:40
up vote 0 down vote accepted

You could copy the raw partition data into a file and run TCHunt on that file. On Linux, you can copy a partition to a file as user root with this command (assuming the partition you are copying is not mounted):

dd if=/dev/sda3 of=/tmp/myfile bs=512

Here, /dev/sda3 is the partition being copied, and /tmp/myfile is the file that will contain the copy.

The same can be done for Windows, but I don't know how. I would just boot the Windows box into a Linux live CD, mount a partition to hold the copy, and use the above dd command to read the (possibly) encrypted partition.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .