say you get a random harddisk into your hands which is encrypted. is it possible just from the layout of the data to see what kind of encryption has been used?

i.e. Bitlocker, Truecrypt, dcrypt?

  • For purposes of this question is the disk in a boot drive, or just a secondary harddrive? – lzam Aug 29 '14 at 22:44
  • This question would probably receive better answers if moved to security.stackexchange.com – Vinayak Aug 30 '14 at 0:54

I don't know about Bitlocker or dcrypt (I've never used them), but TCHunt by 16 Systems was able to detect TrueCrypt volumes on my computer very quickly.

TCHead, another utility by 16 Systems was able to decrypt TrueCrypt headers (with the password, of course) and can be used to brute force passwords for suspected TrueCrypt volumes.

How TCHunt works (from 16 Systems' website):

TCHunt uses a very simple process of elimination.
The program looks at file attributes and inspects file bytes.
If a file is big enough (default 15MB but this can be adjusted),
then that file is tested to see if the file size modulo 512 equals 0.

If the file passes those tests, then another test is performed to determine
if the file contents are random. And as a final test, the program checks the file
for a few common file headers. That's all TCHunt does.

By default, TCHunt only looks for files that are at least 15 MB in size (as mentioned above). This value can easily be changed in the program's source code and re-compiled to work with user supplied minimum file size values.

  • TCHunt can and does produce false positives. – Vinayak Aug 30 '14 at 1:00

You could try the free Encrypted Disk Detector from Magnet Forensics, which is a Windows command line tool :

Encrypted Disk Detector (v2 released 04/22/2013) is a command-line tool that can quickly and non-intrusively check for encrypted volumes on a computer system during incident response.

Currently, Encrypted Disk Detector detects TrueCrypt, PGP, Safeboot, and Bitlocker encrypted volumes, and we’re adding to this list with each new release.

  • I'd like to add that Encrypted Disk Detector only scans for full disk encryption or already mounted volumes which means that if you have TrueCrypt volumes stored on an HDD partition, then EDD will not be able able to detect it. From their website: [EDD] checks for full disk encryption or mounted encrypted volumes – Vinayak Aug 30 '14 at 13:58
  • @Vinayak: This text is not found in the tool's description, and it wouldn't be much of a forensic tool with such a limitation. If the OP tries it, we might know the answer. – harrymc Aug 31 '14 at 8:12
  • The text was actually taken from their blog post about the tool. You'll find it here: magnetforensics.com/… – Vinayak Aug 31 '14 at 10:05
  • And I've already tried using it, hoping it'd be better/faster than TCHunt. It produced a false positive, detecting a factory (recovery?) partition as encrypted due to a damaged boot sector. – Vinayak Aug 31 '14 at 12:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.