[Vol-users] Guidance

Echo6 echo6_uk at yahoo.com
Fri Nov 9 15:44:23 CST 2012

IIRC prior to version 4.3a there was a recognized flaw in Truecrypt regarding the use of encryption keys.  Following that it becomes much harder to recover the keys.


 From: Thilaknath Ashokkumar <thilaknath.ashok at gmail.com>
To: vol-users at volatilityfoundation.org 
Sent: Friday, November 9, 2012 4:38 PM
Subject: [Vol-users] Guidance

Hi I am currently using volatility to retrieve truecrypt keys stored in memory, by accessing a ram dump. Can you please help me out on how to map the exact location of keys using volatility as i am able to list the process running while the image was taken, and hence forth i am not able to narrow down my search criteria , please help me out.

Thank you

Vol-users mailing list
Vol-users at volatilityfoundation.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20121109/d0be0449/attachment.html

More information about the Vol-users mailing list