Hello All,

I'm new to Volatility but am a reasonably experienced forensic examiner.

I'm working on a hiberfil.sys from a WIN7SP1x64 machine and am trying to determine whether a TrueCrypt volume was mounted and, for bonus points, the path to the TrueCrypt volume file.

I've used devicetree and found:

DRV 0x23ea15de0 \Driver\truecrypt
---| DEV 0xfffffa800946f080 TrueCryptVolumeG FILE_DEVICE_DISK
---| DEV 0xfffffa8007127ac0 TrueCrypt FILE_DEVICE_UNKNOWN

So a good start.

Question: Does that tell me that there _IS_ a TrueCrypt volume mounted as the G drive or there _WAS_ a TrueCrypt volume mounted as the G drive, or that there's no way of knowing one way or the other?

filescan shows two entries for \TrueCrypt.exe. The only difference between the two (besides a slight difference in #Ptr) is that one has access of:

R--rwd

and the other:

R--r-d

What should I be discerning from this? Why does one have a write permission that the other does not?

And finally, pslist shows me that TrueCrypt.exe was started but has no exit time.

I'm just not really sure where to go next?
Can anybody suggest anything?

More than happy for someone to tell me to go read X! Just can't find a helpful X to read.

Thank you all,
AB