New Member
May 15, 2008
I am examing a hardrive using encase. i conducted a quick preview and noticed 2 things a truecrypt folder is installed under the program files folder, and the drive has several visible partitions c,d,e,f, with d,e, and f, being small sizes 2-3 gigs. i havent dove in completely on my exam so there are probably some things i will find pretty obviously but if anybody has any tricks, hints or previous expierience with true crypt volumes or folders they can share that would bee great,



Aug 19, 2006
Is there any visible data on those partitions?

Look in Prefetch to see if TrueCrypt has been run. Look at the LNK files to see if there are any references to files contained in those partitions that may be encrypted.

There is a program here that claims to identify TrueCrypt containers.

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu