DD of TrueCrypt enc...
 
Notifications
Clear all

DD of TrueCrypt encrypted drive....need to mount it

6 Posts
6 Users
0 Likes
1,137 Views
(@n00bcfe)
Posts: 26
Eminent Member
Topic starter
 

I have a DD image of a truecrypt encrypted HDD. I need to mount the encrypted image to a drive letter – in Windows.

FTK Imager - no dice - device does not show up in Truecrypt device list
OSForensics - no dice - device does not show up in Truecrypt device list

Any ideas?

 
Posted : 17/05/2017 10:46 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Encase?

 
Posted : 17/05/2017 11:12 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Arsenal Image Mounter is a free physical disk emulator, this should work.
If you cant mount it as a physical disk you could probably copy out the partition an mount it as an encrypted container rather than a disk.

 
Posted : 17/05/2017 11:19 am
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

Is there a partition table followed by 0x55AA in the first sector of the dd image? Is there any plain text to indicate that it is a truecrypt bootable system encrypted drive?

If it is a bootable system encrypted drive mounting will not be simple. If they have simply encrypted the whole disk of a 2nd drive or external drive then mounting would just be as simple as pointing truecrypt at the dd file to mount.

 
Posted : 17/05/2017 1:42 pm
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

Here is a crazy idea Use truecrypt or veracrypt (i suspect it's backwards compatible).

 
Posted : 18/05/2017 1:18 am
(@4144414d)
Posts: 33
Eminent Member
 

If you are trying to get an image of the decrypted data and have the password or the keys have a look at my github project https://github.com/4144414D/pytruecrypt

You should be able to get an image of the decrypted data without needing TrueCrypt or mounting the image.

The image.py example is what you're after.

Adam

 
Posted : 19/05/2017 5:03 pm
Share: