±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 32585
New Yesterday: 7 Visitors: 140

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

DD of TrueCrypt encrypted drive....need to mount it

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Tue May 16, 2017 11:46 pm

I have a DD image of a truecrypt encrypted HDD. I need to mount the encrypted image to a drive letter -- in Windows.

FTK Imager - no dice - device does not show up in Truecrypt device list
OSForensics - no dice - device does not show up in Truecrypt device list

Any ideas?  

n00bcfe
Member
 
 
  

Re: DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Wed May 17, 2017 12:12 am

Encase?
_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 

Igor_Michailov
Senior Member
 
 
  

Re: DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Wed May 17, 2017 12:19 am

Arsenal Image Mounter is a free physical disk emulator, this should work.
If you cant mount it as a physical disk you could probably copy out the partition an mount it as an encrypted container rather than a disk.  

minime2k9
Senior Member
 
 
  

Re: DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Wed May 17, 2017 2:42 am

Is there a partition table followed by 0x55AA in the first sector of the dd image? Is there any plain text to indicate that it is a truecrypt bootable system encrypted drive?

If it is a bootable system encrypted drive mounting will not be simple. If they have simply encrypted the whole disk of a 2nd drive or external drive then mounting would just be as simple as pointing truecrypt at the dd file to mount.  

AmNe5iA
Member
 
 
  

Re: DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Wed May 17, 2017 2:18 pm

Here is a crazy idea: Use truecrypt or veracrypt (i suspect it's backwards compatible).  

MDCR
Senior Member
 
 
  

Re: DD of TrueCrypt encrypted drive....need to mount it

Post Posted: Fri May 19, 2017 6:03 am

If you are trying to get an image of the decrypted data and have the password or the keys have a look at my github project: github.com/4144414D/pytruecrypt

You should be able to get an image of the decrypted data without needing TrueCrypt or mounting the image.

The image.py example is what you're after.

Adam  

4144414D
Member
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 1 of 1