Re: [Vol-users] Was a TrueCrypt volume mounted?

Unfortunately these MRU keys won't give you the volume for the files contained in the TrueCrypt volume. You can see references to the TrueCrypt volume (for printkey -K "Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"), but you can't tell _for sure_ that that's what you're dealing with: REG_BINARY 23 : (S) 0x00000000 4c 00 6f 00 63 00 61 00 6c 00 20 00 44 00 69 00 L.o.c.a.l...D.i. 0x00000010 73 00 6b 00 20 00 28 00 54 00 3a 00 29 00 00 00 s.k...(.T.:.)... 0x00000020 5e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f ^.2...........Lo 0x00000030 63 61 6c 20 44 69 73 6b 20 28 54 29 2e 6c 6e 6b cal.Disk.(T).lnk 0x00000040 00 00 3c 00 03 00 04 00 ef be 00 00 00 00 00 00 ..<............. 0x00000050 00 00 14 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 ......L.o.c.a.l. 0x00000060 20 00 44 00 69 00 73 00 6b 00 20 00 28 00 54 00 ..D.i.s.k...(.T. 0x00000070 29 00 2e 00 6c 00 6e 00 6b 00 00 00 22 00 00 00 )...l.n.k..."... REG_BINARY 24 : (S) 0x00000000 62 00 6c 00 61 00 68 00 20 00 62 00 6c 00 61 00 b.l.a.h...b.l.a. 0x00000010 68 00 2e 00 74 00 78 00 74 00 00 00 5a 00 32 00 h...t.x.t...Z.2. 0x00000020 00 00 00 00 00 00 00 00 00 00 62 6c 61 68 20 62 ..........blah.b 0x00000030 6c 61 68 2e 74 78 74 2e 6c 6e 6b 00 3a 00 03 00 lah.txt.lnk.:... 0x00000040 04 00 ef be 00 00 00 00 00 00 00 00 14 00 00 00 ................ 0x00000050 62 00 6c 00 61 00 68 00 20 00 62 00 6c 00 61 00 b.l.a.h...b.l.a. 0x00000060 68 00 2e 00 74 00 78 00 74 00 2e 00 6c 00 6e 00 h...t.x.t...l.n. 0x00000070 6b 00 00 00 20 00 00 00 k....... REG_BINARY 20 : (S) 0x00000000 70 00 6f 00 69 00 73 00 6f 00 6e 00 5f 00 69 00 p.o.i.s.o.n._.i. 0x00000010 76 00 79 00 2e 00 70 00 79 00 00 00 5a 00 32 00 v.y...p.y...Z.2. 0x00000020 00 00 00 00 00 00 00 00 00 00 70 6f 69 73 6f 6e ..........poison 0x00000030 5f 69 76 79 2e 70 79 2e 6c 6e 6b 00 3a 00 03 00 _ivy.py.lnk.:... 0x00000040 04 00 ef be 00 00 00 00 00 00 00 00 14 00 00 00 ................ 0x00000050 70 00 6f 00 69 00 73 00 6f 00 6e 00 5f 00 69 00 p.o.i.s.o.n._.i. 0x00000060 76 00 79 00 2e 00 70 00 79 00 2e 00 6c 00 6e 00 v.y...p.y...l.n. 0x00000070 6b 00 00 00 20 00 00 00 k....... for printkey -K "Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\folder": REG_BINARY 5 : (S) 0x00000000 4c 00 6f 00 63 00 61 00 6c 00 20 00 44 00 69 00 L.o.c.a.l...D.i. 0x00000010 73 00 6b 00 20 00 28 00 54 00 3a 00 29 00 00 00 s.k...(.T.:.)... 0x00000020 5e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f ^.2...........Lo 0x00000030 63 61 6c 20 44 69 73 6b 20 28 54 29 2e 6c 6e 6b cal.Disk.(T).lnk 0x00000040 00 00 3c 00 03 00 04 00 ef be 00 00 00 00 00 00 ..<............. 0x00000050 00 00 14 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 ......L.o.c.a.l. 0x00000060 20 00 44 00 69 00 73 00 6b 00 20 00 28 00 54 00 ..D.i.s.k...(.T. 0x00000070 29 00 2e 00 6c 00 6e 00 6b 00 00 00 22 00 00 00 )...l.n.k..."... for printkey -K "Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.txt": REG_BINARY 2 : (S) 0x00000000 4e 00 65 00 77 00 20 00 54 00 65 00 78 00 74 00 N.e.w...T.e.x.t. 0x00000010 20 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 ..D.o.c.u.m.e.n. 0x00000020 74 00 2e 00 74 00 78 00 74 00 00 00 72 00 32 00 t...t.x.t...r.2. 0x00000030 00 00 00 00 00 00 00 00 00 00 4e 65 77 20 54 65 ..........New.Te 0x00000040 78 74 20 44 6f 63 75 6d 65 6e 74 2e 74 78 74 2e xt.Document.txt. 0x00000050 6c 6e 6b 00 4a 00 03 00 04 00 ef be 00 00 00 00 lnk.J........... 0x00000060 00 00 00 00 14 00 00 00 4e 00 65 00 77 00 20 00 ........N.e.w... 0x00000070 54 00 65 00 78 00 74 00 20 00 44 00 6f 00 63 00 T.e.x.t...D.o.c. 0x00000080 75 00 6d 00 65 00 6e 00 74 00 2e 00 74 00 78 00 u.m.e.n.t...t.x. 0x00000090 74 00 2e 00 6c 00 6e 00 6b 00 00 00 28 00 00 00 t...l.n.k...(... REG_BINARY 1 : (S) 0x00000000 62 00 6c 00 61 00 68 00 20 00 62 00 6c 00 61 00 b.l.a.h...b.l.a. 0x00000010 68 00 2e 00 74 00 78 00 74 00 00 00 5a 00 32 00 h...t.x.t...Z.2. 0x00000020 00 00 00 00 00 00 00 00 00 00 62 6c 61 68 20 62 ..........blah.b 0x00000030 6c 61 68 2e 74 78 74 2e 6c 6e 6b 00 3a 00 03 00 lah.txt.lnk.:... 0x00000040 04 00 ef be 00 00 00 00 00 00 00 00 14 00 00 00 ................ 0x00000050 62 00 6c 00 61 00 68 00 20 00 62 00 6c 00 61 00 b.l.a.h...b.l.a. 0x00000060 68 00 2e 00 74 00 78 00 74 00 2e 00 6c 00 6e 00 h...t.x.t...l.n. 0x00000070 6b 00 00 00 20 00 00 00 k....... Now if you had files from system disk, you could investigate the LNK files, prefetch files etc etc, but we're only looking at memory... Looking at other registry keys, you can see the volume loaded here (note: use the correct control set): printkey -K "software\microsoft\windows\controlset001\explorer\mountpoints2" [snip] REG_BINARY \??\Volume{77267a55-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 59 TrueCryptVolumeY REG_BINARY #{77267a56-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 59 TrueCryptVolumeY REG_BINARY \??\Volume{77267a57-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 54 TrueCryptVolumeT REG_BINARY \DosDevices\T: : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 54 TrueCryptVolumeT [snip] printkey -K "mounteddevices" (this is found in SYSTEM) [snip] REG_BINARY \??\Volume{77267a55-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 59 TrueCryptVolumeY REG_BINARY #{77267a56-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 59 TrueCryptVolumeY REG_BINARY \??\Volume{77267a57-e86e-11df-9f57-000c29b50598} : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 54 TrueCryptVolumeT REG_BINARY \DosDevices\T: : (S) 0x00000000 54 72 75 65 43 72 79 70 74 56 6f 6c 75 6d 65 54 TrueCryptVolumeT Writing an extremely crude (just enumerates all subkeys of the shellbags keys) shellbags plugin, I was also able to see the TrueCrypt volume at key (Software\Microsoft\Windows\Shell\Bags\Desktop\Desktop): 0650 34 00 11 41 DD 70 20 00 54 52 55 45 43 52 7E 31 4..A.p .TRUECR~1 0660 2E 45 58 45 00 00 48 00 03 00 04 00 EF BE 11 41 .EXE..H........A 0670 29 71 11 41 29 71 14 00 00 00 54 00 72 00 75 00 )q.A)q....T.r.u. 0680 65 00 43 00 72 00 79 00 70 00 74 00 20 00 53 00 e.C.r.y.p.t. .S. 0690 65 00 74 00 75 00 70 00 20 00 37 00 2E 00 31 00 e.t.u.p. .7...1. 06A0 61 00 2E 00 65 00 78 00 65 00 00 00 1C 00 45 05 a...e.x.e.....E. 06B0 00 00 C4 01 00 00 00 00 00 00 .......... So I guess it's time that I go ahead and write a full shellbags plugin... ;-) We can find the TrueCrypt bootloader even though this is not full disk encrypted. This is found in the lsass.exe memory space (used strings plugin to map back): 0fa3050: ea1e 7c00 0020 5472 7565 4372 7970 7420 ..|.. TrueCrypt 0fa3060: 426f 6f74 204c 6f61 6465 720d 0a00 fa33 Boot Loader....3 0fa3070: c08e d88e d0bc 007c fbf6 06b6 7d01 7507 .......|....}.u. 0fa3080: 8d36 057c e8dc 00b8 0090 813e 1304 6a02 .6.|.......>..j. 0fa3090: 7d0e b800 8081 3e13 042a 027d 03b8 0020 }.....>..*.}... 0fa30a0: 8ec0 32c0 bf00 01b9 ffa6 fcf3 aa8c c02d ..2............- 0fa30b0: 0008 8ec0 b102 b004 bb00 01e8 b400 6633 ..............f3 0fa30c0: dbbe 0001 b900 08e8 ba00 6653 bb00 0db1 ..........fS.... 0fa30d0: 06b0 39f6 0646 7d01 7404 b01a b124 e891 ..9..F}.t....$.. 0fa30e0: 0066 5bbe 000d 8b0e b07d e897 0066 3b1e .f[......}...f;. 0fa30f0: b27d 7425 f606 467d 0175 0ec6 0646 7d01 .}t%..F}.u...F}. 0fa3100: b120 f606 b77d 0275 ad8d 3655 7de8 5300 . ...}.u..6U}.S. 0fa3110: 8d36 057c e84c 00eb fe8c c08e d8fa 8ed0 .6.|.L.......... 0fa3120: bc00 80fb 5268 0a0d 6800 7a68 0081 0e68 ....Rh..h.zh...h 0fa3130: e77c 0668 0001 cb83 c406 5a0e 1f85 c074 .|.h......Z....t 0fa3140: 098d 3655 7de8 1b00 ebfe 8a36 b77d 8cc0 ..6U}......6.}.. 0fa3150: 0500 088e c08e d8fa 8ed0 bcfc a7fb 0668 ...............h 0fa3160: 0001 cb33 dbb4 0efc ac84 c074 04cd 10eb ...3.......t.... 0fa3170: f7c3 b500 b600 b402 cd13 7307 8d36 477d ..........s..6G} 0fa3180: e8e0 ffc3 1e06 1f66 33c0 fcac 6603 d866 .......f3...f..f 0fa3190: d1c3 e2f7 1fc3 0044 6973 6b20 6572 726f .......Disk erro 0fa31a0: 720d 0a07 0007 4c6f 6164 6572 2064 616d r.....Loader dam 0fa31b0: 6167 6564 2120 5573 6520 5265 7363 7565 aged! Use Rescue 0fa31c0: 2044 6973 6b3a 2052 6570 6169 7220 4f70 Disk: Repair Op 0fa31d0: 7469 6f6e 7320 3e20 5265 7374 6f72 6500 tions > Restore. 0fa31e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa31f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa3200: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa3210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa3220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa3230: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0fa3240: 0000 0000 0000 0000 0000 0000 0000 55aa ..............U. We can also see what TrueCrypt exes were run: printkey -K "software\microsoft\windows\shellnoroam\muicache" [snip] REG_SZ C:\Documents and Settings\user\Desktop\TrueCrypt Setup 7.1a.exe : (S) TrueCrypt Setup REG_SZ C:\Program Files\TrueCrypt\TrueCrypt.exe : (S) TrueCrypt REG_SZ C:\Program Files\TrueCrypt\TrueCrypt Format.exe : (S) TrueCrypt Format shimcache | grep -i truecrypt [snip] Last Modified: 2012-08-17 14:06:57 , Lastupdate: 2012-08-17 14:09:24 , Path: \??\C:\Documents and Settings\user\Desktop\TrueCrypt Setup 7.1a.exe Last Modified: 2012-08-17 14:09:42 , Lastupdate: 2012-08-17 14:10:02 , Path: \??\C:\Program Files\TrueCrypt\TrueCrypt.exe Last Modified: 2012-08-17 14:09:43 , Lastupdate: 2012-08-17 14:10:12 , Path: \??\C:\Program Files\TrueCrypt\TrueCrypt Format.exe userassist - sadly there were no LNK files listed here for files clicked from within the volume: [snip] REG_BINARY UEME_RUNPATH:C:\Documents and Settings\user\Desktop\TrueCrypt Setup 7.1a.exe : ID: 3 Count: 1 Last updated: 2012-08-17 14:09:24 0x00000000 03 00 00 00 06 00 00 00 60 06 0c e8 81 7c cd 01 ........`....|.. REG_BINARY UEME_RUNPATH:TrueCrypt.lnk : ID: 3 Count: 1 Last updated: 2012-08-17 14:10:02 0x00000000 03 00 00 00 06 00 00 00 a0 96 84 fe 81 7c cd 01 .............|.. REG_BINARY UEME_RUNPATH:C:\Program Files\TrueCrypt\TrueCrypt.exe : ID: 3 Count: 1 Last updated: 2012-08-17 14:10:02 0x00000000 03 00 00 00 06 00 00 00 60 64 9c fe 81 7c cd 01 ........`d...|.. And of course the easiest: using filescan with the patch I've already posted to the list where files of interest are under \Device\TrueCryptVolumeT: filescan |grep -i truecrypt 0x01e59028 1 0 R--r-- \Device\TrueCryptVolumeT\poison_ivy.py 0x01ea0cf0 1 0 -W---- \Device\HarddiskVolume1\Documents and Settings\user\Cookies\user(a)www.truecrypt[1].txt 0x01f8b028 3 0 RWD--- \Device\TrueCryptVolumeT\$BitMap 0x01fc1c60 3 0 RWD--- \Device\TrueCryptVolumeT\$LogFile 0x01fe0478 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\drivers\truecrypt.sys 0x02003028 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\user\Desktop\TrueCrypt Setup 7.1a.exe 0x02008b88 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\All Users\Start Menu\Programs\TrueCrypt\TrueCrypt.lnk 0x0204b208 1 0 R--rw- \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt.exe 0x020bc5e8 1 0 R--r-- \Device\HarddiskVolume1\Documents and Settings\All Users\Start Menu\Programs\TrueCrypt\TrueCrypt Website.url 0x020e1028 1 0 R--r-d \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt.exe 0x020e1c18 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\All Users\Desktop\TrueCrypt.lnk 0x021f1678 1 0 R--rwd \Device\TrueCryptVolumeT\blah blah.txt 0x0223a840 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\user\Application Data\TrueCrypt\Configuration.xml 0x022b78e0 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\All Users\Start Menu\Programs\TrueCrypt\Uninstall TrueCrypt.lnk 0x0233a2f0 1 0 R--r-d \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt Format.exe 0x0234ff90 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\user\Desktop\TrueCrypt Setup 7.1a.exe 0x0235ddd8 1 0 RW-r-- \Device\TrueCryptVolumeT\New Text Document.txt 0x02401490 1 0 R--rw- \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt Format.exe 0x02401490 1 0 R--rw- \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt Format.exe 0x0240c340 1 0 R--rw- \Device\HarddiskVolume1\Program Files\TrueCrypt\TrueCrypt Setup.exe 0x0241f998 2 1 RW---- \Device\HarddiskVolume1\Documents and Settings\user\Desktop\MyTrueCryptVolume 0x02479c98 3 0 RWD--- \Device\TrueCryptVolumeT\$Mft 0x024a6f00 3 0 RWD--- \Device\TrueCryptVolumeT\$Directory 0x024d9028 3 1 R--rwd \Device\TrueCryptVolumeT\ 0x024ec700 3 0 RWD--- \Device\TrueCryptVolumeT\$Mft 0x024f96c0 3 0 RWD--- \Device\TrueCryptVolumeT\$MftMirr You could possibly find these files in MFT entries in memory if 1) the volume was NTFS formatted and 2) the file was accessed sometime recently and the entry was not overwritten. The downside is that unless you know the file you're searching for ahead of time, you can't really associate it with the TrueCypt volume because there are no drive letters in FN and SI of MFT entries. You an also find filenames in INDX( entries, but again these also do not contain drive letters... These could lead you to the location of the TrueCrypt volume itself, however, if it should reside on the system somewhere (it is a file afterall). You might get lucky and find more information in $LogFile entries if they happen to be in memory, for example: 108cc000 [kernel:d1e1b000] RCRD( 108cc06e [kernel:d1e1b06e] +00 108cc074 [kernel:d1e1b074] /T:\ 108cc099 [kernel:d1e1b099] BLAHBL~1.TXT 108cc0bb [kernel:d1e1b0bb] blah blah.txt 108cc108 [kernel:d1e1b108] T:\blah blah.txt 108cc11c [kernel:d1e1b11c] T:\` I'm sure there's like a million other things you can do and it looks like anyway the original poster found a solution on his own. I just thought I'd post the things I found today and maybe someone else will be so inclined to add more just for fun ;-) All the best, -gleeda On Thu, Aug 16, 2012 at 5:58 PM, Andre' M. DiMino &lt;adimino(a)sempersecurus.org&gt; wrote: