Forgot your password?
typodupeerror

+ - TrueCrypt Master Key Extraction And Volume Identification ->

Submitted by Anonymous Coward
An anonymous reader writes "The Volatility memory forensics project has developed plugins that can automatically find instances of Truecrypt within RAM dumps and extract the associated keys and parameters. Previous research in this area has focused specifically on AES keys and led to the development of tools such as aeskeyfind. The Volatility plugin takes a different approach by finding and analyzing the same data structures in memory that Truecrypt uses to manage encryption and decryption of data that is being read from and written to disk. With the creation of these plugins a wide range of investigators can now decrypt Truecrypt volumes regardless of the algorithm used (AES, Seperent, combinations of algos, etc.). Users of Truecrypt should be extra careful of physical security of their systems to prevent investigators from gaining access to the contents of physical memory."
Link to Original Source
This discussion was created for logged-in users only, but now has been archived. No new comments can be posted.

TrueCrypt Master Key Extraction And Volume Identification

Comments Filter:

With all the fancy scientists in the world, why can't they just once build a nuclear balm?

Working...