I'm aware that the plaintext password is used to decrypt the header which stores all the decryption details for the actual data.
So there is no reason to store the actual password in memory once the decrypted header is copied into there.
So my question is:
- Assume an attacker has access to your PC while a TrueCrypt volume is mounted.
- Assume the attacker has the ability to dump driver memory.
- No keyfiles are used.
Will the attacker be able to recover the password you entered? Or will he only be able to recover the decrypted header?
A higher level of this question would be: Will the attacker be able to compromise other unmounted encrypted volumes that use the same password as the mounted one?
- Assume no other unrelated weaknesses of any sort.
Edit: I'm NOT talking about the cipher key(s) stored inside the header. I'm talking about the password that gets salted and hashed to decrypt the header itself.