Re: [Vol-users] Was a TrueCrypt volume mounted?

Hello, So I will assume you are using the latest release of Volatility, which means the 2.1 command reference will give you information about every plugin we have: http://code.google.com/p/volatility/wiki/CommandReference21 The next thing I would do is run the handles plugin [1] and look for any reference to the open file. You can filter with the -p option to be only the TrueCrypt process that you found in pslist, but if you do not see any encrypted container referenced there then you may want to run it across all processes (the default) because we have seen where files opened by drivers end up in other processes' handles (e.g. SYSTEM). I think handles would be more helpful to determine if any files were opened b/c it will show you exactly what truecrypt had open when the machine hibernated. With filescan you would have to already know the name of the encrypted container to see if it was ever opened. Also, MHL suggested using the symlink scan command [2] as this will map drive letters to physical device paths. Here is some sample output for the command: $ python vol.py -f win7x64cmd.dd --profile=Win7SP1x64 symlinkscan Volatile Systems Volatility Framework 2.2_alpha Offset(P) #Ptr #Hnd Creation time From To ------------------ ------ ------ ------------------------ -------------------- ------------------------------------------------------------ 0x0000000007331840 1 0 2011-12-30 08:26:15 Global \Global?? 0x0000000013d6a930 1 0 2012-01-10 18:35:28 Z: \Device\LanmanRedirector\;Z:0...000003b08d\10.1.47.238\setup 0x0000000023bc0140 1 0 2011-12-30 08:25:30 A: \Device\Floppy0 0x000000002ab23430 1 0 2011-12-30 08:25:30 D: \Device\CdRom0 0x000000002d3b8c90 1 0 2011-12-30 08:25:26 C: \Device\HarddiskVolume2 And you can see, C: is mapped to HarddiskVolume2. From there you can run handles and filter specifically to files opened on that device like this: $ python vol.py -f win7x64cmd.dd --profile=Win7SP1x64 handles -t File | grep HarddiskVolume2 Volatile Systems Volatility Framework 2.2_alpha 0xfffffa800248e5a0 4 0x5c 0x12008b File \Device\HarddiskVolume2\Windows\System32\wfp\wfpdiag.etl 0xfffffa800267f300 4 0xa4 0x13019f File \Device\clfs\Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog 0xfffffa800267b540 4 0xa8 0x12019f File \Device\clfs\Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog 0xfffffa8002671350 4 0xac 0x13019f File \Device\clfs\Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLog 0xfffffa80026794e0 4 0xb0 0x12019f File \Device\HarddiskVolume2\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer00000000000000000002 0xfffffa8002679c30 4 0xb4 0x1 File \Device\HarddiskVolume2 If the combination of handles and symlinkscan does not answer your question please write back. Also, it would be interesting if you documented your process through this (assuming you can), as I am sure many other people will encounter this situation. [1] http://code.google.com/p/volatility/wiki/CommandReference21#handles [2] http://code.google.com/p/volatility/wiki/CommandReference21#symlinkscan .... On Thu, Aug 16, 2012 at 8:41 AM, Adam Bridge <adam.bridge(a)yahoo.com> wrote: > Hello All, > > I'm new to Volatility but am a reasonably experienced forensic examiner. > > I'm working on a hiberfil.sys from a WIN7SP1x64 machine and am trying to > determine whether a TrueCrypt volume was mounted and, for bonus points, > the > path to the TrueCrypt volume file. > > I've used devicetree and found: > > DRV 0x23ea15de0 \Driver\truecrypt > ---| DEV 0xfffffa800946f080 TrueCryptVolumeG FILE_DEVICE_DISK > ---| DEV 0xfffffa8007127ac0 TrueCrypt FILE_DEVICE_UNKNOWN > > So a good start. > > Question: Does that tell me that there _IS_ a TrueCrypt volume mounted > as > the G drive or there _WAS_ a TrueCrypt volume mounted as the G drive, or > that there's no way of knowing one way or the other? > > filescan shows two entries for \TrueCrypt.exe. The only difference > between > the two (besides a slight difference in #Ptr) is that one has access of: > > R--rwd > > and the other: > > R--r-d > > What should I be discerning from this? Why does one have a write > permission > that the other does not? > > And finally, pslist shows me that TrueCrypt.exe was started but has no > exit > time. > > I'm just not really sure where to go next? > Can anybody suggest anything? > > More than happy for someone to tell me to go read X! Just can't find a > helpful X to read. > > Thank you all, > AB > > _______________________________________________ > Vol-users mailing list > Vol-users(a)volatilityfoundation.org > http://lists.volatilityfoundation.org/mailman/listinfo/vol-users >