TCDiscover: Discover TrueCrypt Containers on a .DD Harddrive Image!

by Black on April 28, 2011

in Forensics, Open Source, Short Post

We posted about TCHunt yesterday, that could help you identify TrueCrypt encrypted data on your hard drive. But, what if you are not able to load TCHunt and only have access to a backed up hard drive? If that data is backed with dd, you are in luck – for we now have  TCDiscover!

This open source python script was submitted to us via the PenTestIT Submit Your Tool option by Mr. Will Schroeder and Mr. Tyler Dean. So, TCDiscover is a python script that uses entropy calculations to find possible TrueCrypt/encrypted containers on a .DD hard drive image. It can even do so recursively through directories!

It is very simple to use. Run it simply with the following arguments and you are done:

./tcdiscover.py -i <image file>

Download TCDiscover (tcdiscover.py) here.

0

Searches leading to this post:
tcdiscover

If you enjoyed this article, you might also like:

Tagged as: , , ,

Comments on this entry are closed.

Previous post:

Next post: