say you get a random harddisk into your hands which is encrypted. is it possible just from the layout of the data to see what kind of encryption has been used?
i.e. Bitlocker, Truecrypt, dcrypt?
I don't know about Bitlocker or dcrypt (I've never used them), but TCHunt by 16 Systems was able to detect TrueCrypt volumes on my computer very quickly.
TCHead, another utility by 16 Systems was able to decrypt TrueCrypt headers (with the password, of course) and can be used to brute force passwords for suspected TrueCrypt volumes.
How TCHunt works (from 16 Systems' website):
TCHunt uses a very simple process of elimination. The program looks at file attributes and inspects file bytes. If a file is big enough (default 15MB but this can be adjusted), then that file is tested to see if the file size modulo 512 equals 0. If the file passes those tests, then another test is performed to determine if the file contents are random. And as a final test, the program checks the file for a few common file headers. That's all TCHunt does.
By default, TCHunt only looks for files that are at least 15 MB in size (as mentioned above). This value can easily be changed in the program's source code and re-compiled to work with user supplied minimum file size values.
You could try the free Encrypted Disk Detector from Magnet Forensics, which is a Windows command line tool :
Encrypted Disk Detector (v2 released 04/22/2013) is a command-line tool that can quickly and non-intrusively check for encrypted volumes on a computer system during incident response.
Currently, Encrypted Disk Detector detects TrueCrypt, PGP, Safeboot, and Bitlocker encrypted volumes, and we’re adding to this list with each new release.