Date: Sat, 09 May 2015 22:03:43 +0100 From: Demian Smith <demian.smith@....de> To: john-users@...ts.openwall.com Subject: Re: Advise on best approach (truecrypt pw based on pdf file) Hi, > If someone with a truecrypt encrypted Windows system partition can > verify that the known password works when running truecrypt2john and > john, then there is obviously no need to share any more details than > just confirming that it worked. > Is that a truecrypt encrypted Windows System partition, or just a normal > partition or truecrypt volume? In this case it's not a windows partition but an external RAID1, fully disk encryption with truecrypt. I did create a full encrypted second device (USB flash key) and truecrypt2john was extracting hashes and did find the correct "guess2 from a wordlist. However, the RAID had been encrypted on Windows, whereas the flash key has been done on linux. Should this matter? > If that's it, we can create permutation rules tailored for this and should be able to crack it. I think you should concentrate on this for a while before resuming that incremental run. Thanks for the pointer, I will look into these - I did not yet use them at all up till now. > Note that it still says 44.21p/s here but that's just the average speed from job start so this figure will now increase slowly towards your new faster figure. I was wondering about this, but (naturally) you're right and the number keeps slowly climbing up. > Let's concentrate on wordlist rules. If it's indeed a partial sentence, would you think it's truncated in the end and still starting with an uppercase letter? It does start with a upper case letter, that's for sure. If I understand correctly, it would have been truncated at the end - if the original sentence would have been > To be or not to be, that is the question, and indeed a question which shall > be answered, by this circle of fine man who gathered on this moonlit December night It would be any of these Tbontb Tbontbtistq Tbontbtistqaiaqwsba Tbontbtistqaiaqwsbabtcofm and so on. I have tried replacing "and" with a fullstop to force a linebreak with sed, but this would not work if it would have been two ands in a sentence or a comma ... > Also, how large (number of lines) is that wordlist? Did you try just running it with --rules (and perhaps --rules=single in another run)? The list I have created by removing all lines starting with non capital letters is a whopping 3803 lines long, but the last lines are in the ranks of 50 and more chars (the longest being 97 chars). After your pointer towards rules I have now cut the lines at 20 chars and am running it with the rules on the wordlist. I've not worked with rules either, would I have to write some useful ones (for my case) first? Cheers, Demian
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.