0

I have a HDD which I encrypted few years ago but I can't remember the tool I used. How can I find out if I have used TrueCrypt or VeraCrypt to encrypt my hard drive?

Thanks.

user3646958
  • 9
  • 1

2 Answers2

1

Neither VeraCrypt nor TrueCrypt have a header or signature that would allow you to detect which encryption was used. So you just have to determine if that particular tool can successfully decrypt your data by trying.

HBruijn
  • 72,524
  • 21
  • 127
  • 192
  • Thank you. But I used a hex editor. I saw the string "VeraCrypt Bootloader" in the first bytes of the hdd. – user3646958 Apr 30 '18 at 17:42
  • These links refer to the format of the containers created by these tools and not the format of a volume based encryption created by these tools. – WMIF May 02 '18 at 00:01
0

This all depends on how exactly you created the encrypted data. When you use 'full disk encryption' you are really using volume encryption. The disk structures are still in place (master boot record, volume boot record, and sometimes the file system). The data inside the volume is where the encryption is applied.

If you used TrueCrypt or any of its variants, you had an option to create an encryption container. This option creates a file, similar to a zip file, on an already established file system. That file system can also be encrypted.

If you plug the disk in and you see folders with a big file, then you likely used a container. If instead you get a message of an unrecognized volume and possibly a prompt to format the disk, then you might have used volume based encryption (full disk encryption).

WMIF
  • 340
  • 2
  • 6