The forensic analysis of encrypted Truecrypt volumes

In this paper, we investigate the inner encryption principles of Truecrypt volumes including cryptographic algorithms, encryption mode, key derivation way and password verifying process. Besides, we explain the forensic operation by password cracking with concrete data instances. Our research could be helpful in two scenarios of Truecrypt application: one is to enable a personal user to retrieve his forgotten password, the other is to provide computer forensic analysis of criminal activity. To the best of our knowledge, this is the first time that the complete and explicit password cracking details are presented publicly and finally we also give some suggestion to enhance the security of Truecrypt encryption.