TestCrypt question

[wil70]

Hello, Is there a way to run TestCrypt on a Raw image?
(Basically I have the TC password but I do not know where is the TC header on the 3rd partitions of the d drive).

Story:
I have 2 drives, c (500GB) and d (1TB), both encrypted via TC.
I need to find the TC header from an image from a drive with 3 partitions (d drive). I can not do it on the native drive because I unfortunatly use the wrong "TC rescue disk (from c drive)" on my D drive (which decrypted it with the wrong key, so I used untrue from nccgroup to encrypt again with the "TC rescue disk (from c drive)" (which generated a raw image), it seems to have work as I can read some text (thought the partition size do not look right), but now I need to locate the TC header from my raw image (of d drive) so I can try to mount it in truecrypt, so I can read the rest of the d drive (like the 3rd partition)

Sorry I do not speak German (English and French only so far)

Thanks for your help

Sincerely

Wil

 

[Simpson474]

TestCrypt does not support working with disk images: however, Windows 8 and later finally support attaching VHD images as virtual disks. Using converters like VhdTool (a download link can be found here), it should be possible to convert a RAW image to VHD as described here.

 

[wil70]

thanks Simpson474
I tried vhdtool:
H:\Image of D>..\vhdtool /convert WIL_D_drive_Physical.001
Status: Converting "WIL_D_drive_Physical.001" to a fixed format VHD.
Status: Attempting to open file "WIL_D_drive_Physical.001"
Status: File opened, current size is 1000204886528
Status: Performed seek to end of file.
Status: VHD footer generated.
Status: VHD footer appended.
Status: Complete

But when I try to mount it with "Computer Management" > Action > Attached Vhd, it says "A Virtual disk support provider for the specified file was not found"
So I dig on internet and change something in the registry, reboot, still not working (https://support.microsoft.com/en-us/kb/2013544)
The raw image file has been created with "Access Data FTK Imager", it works well with UnTrue.
I also tried to mount it as a raw image file, that works well but TestCrypt doesn't see it has a physical drive so I can not run it on this mounted drive.
Do not hesitate to share if you have another idea I can try?

Thanks for your help

Wilhelm