1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Someone please help me, my hard drive is damaged and my TruCrypt password is no longer wor

Discussion in 'BlackHat Lounge' started by mynameis11, Mar 19, 2014.

  1. mynameis11

    mynameis11 Newbie

    Joined:
    Jun 19, 2013
    Messages:
    15
    Likes Received:
    4
    Location:
    Australia
    I'm not sure if this is the correct place to post, so if not please let me know where is better so I can repost of appropriate.

    1. My troubles started after I stupidly transported my laptop in the boot of my car. I'm presuming that the Hard drive has sustained some sort of damage. My entire hard drive is encrypted using TruCrypt, including the OS (Whole of disk encryption).

    2. My TruCrypt password no longer works now. When I type in the correct password, it fails to authenticate as though I have typed in the wrong password.

    3. I have managed to bypass password authentication by using the TruCrypt rescue disk, however once the hard drive boots, instead of loading Windows, Windows startup repair loads.

    4. Startup repair fails to fix the problem and there are no system restore points.

    5. I cannot seem to decrypt the volume using the rescue disk without the password which is still not working, despite me being 100% confident that I am using the correct password.

    Can anyone help me? I need the data from the volume and I'm stuck for ideas.
     
  2. jazzc

    jazzc Moderator Staff Member Moderator Jr. VIP

    Joined:
    Jan 27, 2009
    Messages:
    2,468
    Likes Received:
    10,143
    The whole idea of TC is that an offline attacker can't break in, so your request is rather futile. Hopefully you had a back up of your data.
     
    • Thanks Thanks x 1
  3. mynameis11

    mynameis11 Newbie

    Joined:
    Jun 19, 2013
    Messages:
    15
    Likes Received:
    4
    Location:
    Australia
    The whole idea of a TruCrypt rescue disk is to bypass authentication and grant access to the encrypted data, which I believe I have done. The problem remains that I cannot start Windows to actually access the data without restarting the computer, which again locks down the data.

    My thinking is that provided I have the rescue disk that there is some way I can either repair Windows, access the data or decrypt the volume.
     
  4. jazzc

    jazzc Moderator Staff Member Moderator Jr. VIP

    Joined:
    Jan 27, 2009
    Messages:
    2,468
    Likes Received:
    10,143
    Nope. You should have read the documentation better. The rescue disk does not bypass the authentication my any means, it merely fixes a broken bootloader or a broken master key file. You always need the password.

    That said, your best bet is to read the rescue disk 's documentation as it lists the usual problems and their solutions.
     
    • Thanks Thanks x 2
  5. mynameis11

    mynameis11 Newbie

    Joined:
    Jun 19, 2013
    Messages:
    15
    Likes Received:
    4
    Location:
    Australia
    Thanks, I will refer back to the resucue disk documentation and also the TruCrypt forums, hopefully I can figure out what to do from there.

    My theory (and hope) is that since I have gotten as far as the Windows startup recovery screen (which is a Windows feature) that I will somehow be able to recover the data.

    The problem may very well be something to do with a broken bootloader or a broken master key file, so I will take a look into this as well.
     
  6. Tensegrity

    Tensegrity Jr. VIP Jr. VIP Premium Member

    Joined:
    Apr 22, 2009
    Messages:
    1,823
    Likes Received:
    968
    People should learn about encryption technologies before using them.
    Sayin..
     
  7. Apricot

    Apricot Administrator Staff Member Moderator

    Joined:
    Mar 26, 2013
    Messages:
    11,962
    Likes Received:
    6,444
    Gender:
    Female
    Occupation:
    BHW Moderator
    Location:
    London
    Home Page:
    Sounds silly, but MAKE SURE it is that password. Sometimes your mind can go into auto-mode and when you go through in your mind when you set the password and what it could be, sometimes something can just click.

    As I've learnt so many times though and it's easy to say now, BACKUP FREQUENTLY.
     
  8. 808080Hat

    808080Hat Registered Member

    Joined:
    Feb 1, 2014
    Messages:
    65
    Likes Received:
    24
    Occupation:
    Freelance Software Developer/Architect
    Location:
    Berlin, Germany
    My guess is that you need to start a linux (knoppix/ubuntu) from a usb stick and try to recover your data from there. Truecrypt is available for linux and linux can be used to recover data from dead windows partitions. Don't write to your disk, mount it readonly.