Is there a way to find all hidden TrueCrypt containers on my system?

Question

Years ago, I encrypted some of my pictures with TrueCrypt. Now I can't find the container anymore. I suspect I used a hidden container, maybe I accidentally erased it. Is there a way to find all hidden TrueCrypt containers on my system?

I guess not, because the purpose of them is to be hidden, but I'm glad for every bit of help I get.

score 3 · Accepted Answer · answered Jul 30 '13 at 16:11

3

well, a hidden container has to be inside a non-hidden container. Try your hidden container password on all of your non-hidden truecrypt files/partitions until it works on one.

answered Jul 30 '13 at 16:11

Rod MacPherson

405

That means I erased it. Because there is no *.tc-file on my system. Thank you anyway! – Sebastian Starke Jul 30 '13 at 16:19
1

@Lord_Mord: Please keep in mind a TrueCrypt container does not necessarily need to have the .tc suffix. TrueCrypt volume can be also stored directly on a disk volume. If the data are really valuable you can try to use some kind of entropy analysis to find encrypted data on your system. – pabouk - Ukraine stay strong Jul 30 '13 at 17:26

score 2 · Answer 2 · answered Jul 30 '13 at 16:21

2

for all intents and purposes, no.

if it is possible for you to do as you ask, then that means you seriously screwed up your implementation of the hidden volume (they are designed so that no one can answer the question you pose), and only a researcher with custom tools will be able to detect it even then.

answered Jul 30 '13 at 16:21

Frank Thomas

36,135

Please check the question again. OP did not say that he does not know the password to the hidden volume so you answer could be a little bit irrelevant. He can simply try to open the hidden volume. The second link you posted describes situation which helps to detect existence of a hidden volume on the system (and we know that there was one) but it will not probably help at all with finding out in which of multiple TrueCrypt volumes the hidden volume resides. – pabouk - Ukraine stay strong Jul 30 '13 at 17:18
not at all. you cannot 'find' hidden volumes on a system. you can attempt to locate all the potential TC files and attempt to open them with a given password, but thats not 'finding' all the hidden volumes. – Frank Thomas Jul 30 '13 at 20:30

Is there a way to find all hidden TrueCrypt containers on my system?

2 Answers2