TrueCrypt - Revision history

Andbel: Added reference to unprotect.info software

2011-05-13T18:05:36Z

Added reference to unprotect.info software

2008-12-31T08:36:22Z

Category:Disk encryption

2008-12-29T23:38:08Z

2008-09-13T19:32:08Z

2008-07-20T16:00:42Z

2008-07-20T15:59:14Z

some errors

2008-07-09T19:44:52Z

added Category

2008-07-09T19:29:08Z

Removed obsolete information about hidden volumes on FAT. Added some other things.

2008-07-05T16:20:58Z

wfy

2007-12-17T12:45:16Z

Keyfiles, plausible deniability.

@@ Line 15: / Line 15: @@
 == Attacks ==
-The only option for acquiring the content of a dismounted TrueCrypt drive is to do a brute-force password guessing attack. [[AccessData|AccessData's]] [[Password Recovery Toolkit]] and Distributed Network Attack ([[DNA]]) can both perform such an attack, but DNA is faster.
+The only option for acquiring the content of a dismounted TrueCrypt drive is to do a brute-force password guessing attack. [[AccessData|AccessData's]] [[Password Recovery Toolkit]] and Distributed Network Attack ([[DNA]]) can both perform such an attack, but DNA is faster. Another solution is [[unprotect.info]] that can brute-force password to the file-based encrypted volumes.
 TrueCrypt also supports keyfiles (it uses the first 1024 kilobytes of any file, but can also use it's PRNG to generate such keys). It is important to look for anything that might be used as a keyfile (such as a 1024k file on a USB stick).

@@ Line 8: / Line 8: @@
 }}
-'''TrueCrypt''' is an open source program to create and mount virtual encrypted disks in [[Windows|Windows Vista/XP/2000]] and [[Linux]] and [[Mac OS X|OS X]] as well as [[Whole Disk Encryption]] on Windows. It provides two levels of plausible deniability (hidden values / no signatures to make a distinction from random data), on the fly encryption and supports various encryption algorithms ([[AES|AES-256]], [[Serpent]] and [[Twofish]]).  As of version 6.0 TrueCrypt now supports hidden Operating Systems (Windows only).
+'''TrueCrypt''' is an open source program to create and mount virtual encrypted disks in [[Windows|Windows Vista/XP/2000]] and [[Linux]] and [[Mac OS X|OS X]] as well as [[Whole Disk Encryption]] on Windows. It provides two levels of plausible deniability (hidden values / no signatures to make a distinction from random data), on the fly encryption and supports [[AES]], [[Serpent]] and [[Twofish]].  As of version 6.0 TrueCrypt now supports hidden Operating Systems under Windows only.
 == Forensic Acquisition ==

@@ Line 31: / Line 31: @@
 Hidden operating system is a system that is installed in a hidden TrueCrypt volume.
-It is possible to detect network-enabled hidden operating systems by matching downloaded content (from network dump) with data on possible decoy system.
+It is possible to detect network-enabled hidden operating systems by matching downloaded content (from a network dump) with data on a possible decoy system.
-Investigator can also detect boot times by searching network dumps for IP packets with low IDs (only if Windows system is permanently connected to a LAN) and [[TCP timestamps]].
+Investigator can also detect boot times by searching network dumps for IP packets with low IDs (only if [[Windows]] system is permanently connected to a LAN) and [[TCP timestamps]].
 == External Links ==

@@ Line 25: / Line 25: @@
 When a hidden volume is mounted, the operating system and third-party applications may write to non-hidden volumes information about the data stored in the hidden volume (e.g. filenames). It is important to look for such kind of information.
-Previous versions of encrypted containers may be found in the journaling filesystems. It is important to track any changes within the free space of the outer volume to detect presence of a hidden container.
+Previous versions of encrypted containers may be found in the journaling filesystems. It is important to track any changes within the free space of the outer container to detect presence of a hidden container.
 == Hidden Operating Systems ==
@@ Line 33: / Line 33: @@
 It is possible to detect network-enabled hidden operating systems by matching downloaded content (from network dump) with data on possible decoy system.
-Investigator can also detect boot times by searching network dumps for IP packets with low IDs (only if Windows system is permanently connected to a LAN).
+Investigator can also detect boot times by searching network dumps for IP packets with low IDs (only if Windows system is permanently connected to a LAN) and [[TCP timestamps]].
 == External Links ==

← Older revision		Revision as of 19:44, 9 July 2008
Line 39:		Line 39:
	* [http://www.truecrypt.org/ Official website]		* [http://www.truecrypt.org/ Official website]
	* [http://www.truecrypt.org/docs/?s=version-history Version history]		* [http://www.truecrypt.org/docs/?s=version-history Version history]
		+
		+	[[Category:Encryption]]

@@ Line 14: / Line 14: @@
 If you encounter a system that has a mounted TrueCrypt drive, it is imperative that you capture the contents of the encrypted drive before shutting down the system. Once the system is shutdown, the contents will be inaccessible unless you have the proper encryption key generated by a user's password. You may also need an additional datafile.
-==Attacks==
+== Attacks ==
-The only option for acquiring the content of a TrueCrypt drive is to do a brute-force password guessing attack. [[AccessData|AccessData's]] [[Password Recovery Toolkit]] and Distributed Network Attack ([[DNA]]) can both perform such an attack, but DNA is faster.
+The only option for acquiring the content of a dismounted TrueCrypt drive is to do a brute-force password guessing attack. [[AccessData|AccessData's]] [[Password Recovery Toolkit]] and Distributed Network Attack ([[DNA]]) can both perform such an attack, but DNA is faster.
 TrueCrypt also supports keyfiles (it uses the first 1024 kilobytes of any file, but can also use it's PRNG to generate such keys). It is important to look for anything that might be used as a keyfile (such as a 1024k file on a USB stick).
-The existence of a FAT volume may be an indication of the existence of hidden volumes (a hidden volume can only be created within a FAT TrueCrypt volume).
+== Hidden volumes ==
 == External Links ==

@@ Line 1: / Line 1: @@
-'''TrueCrypt''' is an open source program to create and mount virtual encrypted disks in [[Windows|Windows Vista/XP/2000]] and Linux. It provides two levels of plausible deniability (hidden values / no signatures to make a distinction from random data), on the fly encryption and supports various encryption algorithms (AES-256, Serpent and Twofish).
+{{Infobox_Software |
 == Forensic Acquisition ==
@@ Line 15: / Line 24: @@
 * [http://www.truecrypt.org/ Official website]