Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Apparently can be used to crack truecrypt hard drive encryption. Has anyone tried it and is it possible to crack truecrypt files too with this software?

Passware Kit Forensic, complete with Passware FireWire Memory Imager, is the first and only commercial software that decrypts BitLocker and TrueCrypt hard disks, and instantly recovers Mac and Windows login passwords of seized computers.

share|improve this question
I'm pretty skeptical of this. – cutrightjm Dec 11 '12 at 17:10
@ekaj- it is a legit vulnerablity, but the list of caveats is long, and its really an attack on windows rather than on Truecrypt or any of its cipher implementations. It made slashdot 3 or 4 years ago. – Frank Thomas Dec 11 '12 at 17:12
up vote 12 down vote accepted

This attack only works on Full-Disk Encrypted systems, or otherwise requires that the volume be mounted at the time the attack is undertaken (or when the system last hibernated). the attack works by accessing the key in ram, which wouldn't be possible in the case of a unmounted volume. If the key cannot be found in memory, it attempts to find it in hiberfil.sys, but if the volume was not loaded during the last hibernation, the key will not be there either.

NOTE: If the target computer is turned off and the encrypted volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns brute-force attacks to recover the original password for the volume.

So, use a strong password, disable hibernation, and do not mount volumes on boot (only mount on demand when you need to, and dismount when you are done) and you should be pretty safe against this tool.

share|improve this answer
Meh, makes sense. – cutrightjm Dec 11 '12 at 17:14
You don't have to completely disable hibernation, just don't do it with a tc volume mounted. – martineau Dec 11 '12 at 18:04
It also seems like if you used a key file that you kept on a thumbdrive that only you possessed, that it would be impossible. – martineau Dec 11 '12 at 18:13
you are right on the hibernation. not sure on the keyfile. most of the time, files that are used are loaded into ram, so unless theres something I'm missing, the key file would then be present in the memory image. – Frank Thomas Dec 11 '12 at 19:13

I strongly doubt this. The only decryption methods for truecrypt containers to my knowledge are brute force ones, and thus if you have a strong passphrase and your system is not compromised by a keylogger or other malware it will not be possible to recover a truecrypt file within minutes. This is an article about an truecrypt brute force tool, unfortunately in german, but it's quite slow and so I really doubt the statements made for this toolset.

Since beeing downvoted I want to clarify my statement: if you have a dismounted Truecrypt container and no hiberfil to look for the password chances will be minimal with brute force in case of a strong password. Of course, a system in hibernation state and with mounted truecrypt container you are vulnerable.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.