I think I found a method. Do you guys think this method will do what I want, copy the relevant partitions byte for byte?...
CWM does seem to make an image but I can't find any info on imaging the internal SD to an external one. I may try emailing the developer and...
Thanks but it looks like this only copies files over, doesn't create an image. I can't get that method to work anyway
Is it possible to create a raw image of an Android tablet, preferably onto an SD card? I'd like to create a complete raw image, including empty...
Yes I agree, nothing seems to be recoverable. But I definitely didn't mess all this up in WinHex. Remember, I copied that final DXML chunk...
Edit: I found the first occurrence of the header (AC 68 42 2B....) and it's right after one of the new files I put onto the drive--- a 100gb TC...
It's not physically possible to brute force the 256 bit AES key right? My understanding is it would take billions of years or something like that....
I don't know much about this stuff except what I've learned from my thread (http://www.wilderssecurity.com/showthread.php?t=329860) But I think...
GDB found no NTFS partition... but I just realized the outer partition would be FAT32 anyway. I only own the NTFS version. WinHex found no...
It has to be the outer volume header, because the password that works is the one I use for my outers. The outer volume would only have had a few...
The size of the outer volume should be displayed as the full partition size right? In this case it should be 466GB, but TC says 54760570880 bytes...
I checked 1FFF, 1FFFF, etc on both the disk and the image and they're the same. I didn't check every single byte though. I didn't mess up the...
I made a new temp copy of the 500MB final chunk from the DXML image (in case WinHEX had messed up the one I was working with), and it's the same...
OK, I'll try that one. WinHex just finished imaging the drive (I made an image to try PassWare on). It copied 972,768,000 sectors instead of...
I promise I'm not messing with you! When I started it up, I selected read only mode with the forensic interface. Well actually the first time I...
I'm guessing this means the data is lost... Unless the hidden volume header is somewhere other than the very end of the partition. One more thing...
I must be going insane... I accidentally went to 1FFFFF offset from the end. The bytes there are exactly the same as the ones at 1FFFF. I'm...
Thanks. Yeah, I was thinking about trying it with a test container. My steps are accurate. I imaged the partition, then I mounted it with TC and...
Thanks, Dantz. Yesterday I opened the DriveimageXML image file in WinHex (actually just the last piece since I have it segmented into 4gb...
I just had an idea. Is it possible to manually extract the header, decrypt the key from it using the password, and attempt to mount the drive...
I asked about this on the TrueCrypt forum but didn't get any help. By Googling for information I discovered that this forum seems to have some...
Separate names with a comma.
