11:38 a.m.
Hi I am currently using volatility to retrieve truecrypt keys stored in
memory, by accessing a ram dump. Can you please help me out on how to map
the exact location of keys using volatility as i am able to list the
process running while the image was taken, and hence forth i am not able to
narrow down my search criteria , please help me out.
Thank you
Thilaknath
4:44 p.m.
IIRC prior to version 4.3a there was a recognized flaw in Truecrypt regarding the use of
encryption keys. Following that it becomes much harder to recover the keys.
Jon.
________________________________
From: Thilaknath Ashokkumar <thilaknath.ashok(a)gmail.com>
To: vol-users(a)volatilityfoundation.org
Sent: Friday, November 9, 2012 4:38 PM
Subject: [Vol-users] Guidance
Hi I am currently using volatility to retrieve truecrypt keys stored in memory, by
accessing a ram dump. Can you please help me out on how to map the exact location of keys
using volatility as i am able to list the process running while the image was taken, and
hence forth i am not able to narrow down my search criteria , please help me out.
Thank you
Thilaknath
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
5:46 p.m.
You should try this
http://passionateaboutis.blogspot.com.es/2011/11/cryptoscan-fixed-windows-v…
Good luck!
El 09/11/2012 17:38, Thilaknath Ashokkumar escribió:
Hi I am currently using volatility to retrieve
truecrypt keys stored
in memory, by accessing a ram dump. Can you please help me out on how
to map the exact location of keys using volatility as i am able to
list the process running while the image was taken, and hence forth i
am not able to narrow down my search criteria , please help me out.
Thank you
Thilaknath
6:59 a.m.
@neofito
Are cryptoscan and suspicious compatible with 2.3 rev.2775? They somehow
fail to load for me.
Also, were you able to get the keys from systems using the older
versions of Truecrypt?
Btw, thank you for providing info for those plugins!
On 11/10/12 12:46 AM, neofito wrote:
You should try this
http://passionateaboutis.blogspot.com.es/2011/11/cryptoscan-fixed-windows-v…
Good luck!
El 09/11/2012 17:38, Thilaknath Ashokkumar escribió:
Hi I am currently using volatility to retrieve
truecrypt keys stored
in memory, by accessing a ram dump. Can you please help me out on how
to map the exact location of keys using volatility as i am able to
list the process running while the image was taken, and hence forth i
am not able to narrow down my search criteria , please help me out.
Thank you
Thilaknath
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
5:29 a.m.
Are cryptoscan and suspicious compatible with 2.3
rev.2775? They somehow
fail to load for me.
The latest compatible version for both plugins was volatility 1.3
although you can use the binaries provided by Bartosz Inglot.
Also, were you able to get the keys from systems using
the older
versions of Truecrypt?
You should read this:
http://passionateaboutis.blogspot.com.es/2011/10/updated-cryptoscan-for-vol…
[Quote]
For a passphrase to be stored in a memory by TrueCrypt, an option “Cache
passwords and keyfiles in memory” needs to be selected.
[/Quote]
Cheers!
4386
days inactive
4388
days old
vol-users@lists.volatilityfoundation.org
4 comments
4 participants
participants (4)
-
Echo6 -
Giotis -
neofito -
Thilaknath Ashokkumar