Collaborate Disseminate
2014 is extremely volatile. Any minute now, it will be gone. Thus, we wanted to take a minute and preserve some of the more exciting memories. Specifically, we wanted to summarize how the memory forensics field and Volatility community has progressed t… Continue reading Acquiring Memor(ies) from 2014
I have been researching LUKS vs TrueCrypt topics — my only concern is security, but most of the discussions I see focus around usability / interoperability .
I know TrueCrypt has a bunch of nice passphrase features — slow … Continue reading TrueCrypt VS LUKS Bruteforce Resilience
I am looking to encrypt a few drives of mine, and my ONLY interest is security. It is OK if my VeraCrypt volumes are not compatible with TrueCrypt, and vice versa.
There is a lot of talk about “TrueCrypt is dead” and it see… Continue reading Is there a reason to use TrueCrypt over VeraCrypt?
This video shows how to use Volatility’s new Truecrypt plugins to defeat disk encryption on suspect computers running 64-bit Windows 8 and server 2012.
The video is narrated by Apple’s text to speech and you can find the actual text on the Youtube … Continue reading Volatility 2.4 at Blackhat Arsenal – Defeating Truecrypt Disk Encryption
A couple of months ago, on my pc with Windows 7, I installed truecrypt and created a decoy system and a hidden OS.
I stored some really important documents and files on my hidden OS that I now need to recover (to an external… Continue reading TrueCrypt Hidden OS Decryption
While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names (and metadata). It was terr… Continue reading Mitigating TrueCrypt Attack Vectors in Memory and System Cache
I’m trying to simulate a possible attack scenario for my studies.
I’ve got a image, which has a encrypted disk, encrypted by TrueCrypt (confirmed).
TrueCrypt is installed on the image itself too.
During a RAM analysis of th… Continue reading An attacker got a few 128bit TrueCrypt keys from a RAM analysis. What can he do?
If I change the extension of a Keepass database (i.e. change the .kdbx to something like .txt), Keepass is still able to open it. Is this an effective way for hiding the databases from an adversary?! Probably no. So, what methods are ther… Continue reading Hiding Keepass databases and Truecrypt containers
I currently have a fully encrypted Windows System, and I’m looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient?
On windows this would be problematic due to software leaking out some po… Continue reading Is encrypting home sufficient?
On my old computer I used Truecrypt full disk encryption. My old computer however was running Windows 7 with a standard MBR partition scheme. I recently got a new laptop with the fancy UEFI support. Yes I know I could alwa… Continue reading Full Disk Encryption with GPT disk support