Need help with Veracrypt container. how to get a hash for you guys to work with ?

[Monica]

Hi
Im not super fluent in hashes so please be patient with me..

I have a veracrypt container that has been encrypted with a password. Client says he remembers the password more or less but having tried all the combinations its not opening.
There is a possibility that the file is corrupted, but most likely the password was forgotten.
there is a very old dated backup as well, but for that (a different ..) password is completely forgotten

Now, how do i extract a hash from it so i can have you guys have a go at it ?

i can pay 300-500$ for the working password, but i understand that i shouldn't post this in paid password recovery without actual hash attached.

i dont know where to begin and googling that proven that i dont know how to google things..

Please help

 

[freeroute]

https://hashcat.net/wiki/doku.php?i...o_i_extract_the_hashes_from_truecrypt_volumes

 

[logos]

If possible, you could also ask your client if they have any recollection at all what hash algorithm they chose when creating the container.
It's a long shot but would make the work a bit shorter if they happened to remember it.

 

[Monica]

https://hashcat.net/wiki/doku.php?i...o_i_extract_the_hashes_from_truecrypt_volumes

Truecrypt and veracrypt operate the same ?

If possible, you could also ask your client if they have any recollection at all what hash algorithm they chose when creating the container.
It's a long shot but would make the work a bit shorter if they happened to remember it.

I know it, it's the default one SHA-512

 

[freeroute]

Truecrypt and veracrypt operate the same ?


I know it, it's the default one SHA-512

"The procedure to extract the important information from data encrypted with VeraCrypt follows the same steps/rules as for TrueCrypt: see How do I extract the hashes from TrueCrypt volumes?
It's important that you do not forget to adapt the hash mode (-m). For all supported hash modes for data encrypted with VeraCrypt, please have a glance at the --help output."

 

[Monica]

OK, is there ELI5 version of that instruction ? idk where to begin. the thing is an encrypted file container, so option 3 and im to extract first 512 bytes.. using what ?..

 

[freeroute]

OK, is there ELI5 version of that instruction ? idk where to begin. the thing is an encrypted file container, so option 3 and im to extract first 512 bytes.. using what ?..

"You'll need to extract the first 512 bytes of the target volume, save them as a file, and use that file as the hashcat target. (Boot drives require pulling the 512 bytes starting later in the drive, but non-boot drives can be treated like file-level containers, pulling the first 512 bytes.)

On Windows, you can use dd for windows to do so. Use dd --list to determine the drive ID for the drive, and then:
dd if=\\.\Volume{volume-guid} of=c:\temp\veracrypt-target.img bs=512 count=1
and:
hashcat -a 3 -w 3 -m 137xx c:\temp\veracrypt-target.img"

https://security.stackexchange.com/questions/159461/hashcat-on-veracrypt-non-system-drive
https://hashcat.net/forum/thread-5833.html

 

[Monica]

what if its not a drive, but a file ?

 

[Monica]

Yea i misunderstood, i dont know what "drive id" is in this context..

 

[logos]

what if its not a drive, but a file ?

As an alternative method you can also use a hex editor for the extraction if operating one of those feels more comfortable.

 

[Monica]

OK it's taken me a while but i think i got the files hashed, now do i make a new thread ?