28Mar
Using DD to get the hash of a non-system partition encrypted by VeraCrypt
I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem.
The command I used to get the hash of the encrypted partition looks like this
dd if=\\?\Device\HarddiskVolume11 of=hash_output.txt bs=512 count=1
And this command (in theory) should create a file called hash_output.txt that contains the encrypted hash that should, for example, look something similar to this:
(Šö÷…o¢–n[¨hìùlŒ‡¬»J`<Q›þIšê1ªCúÍbÔcN„ÐŒ3+d.dWr€-¡tä66¶ˆÎ
However, the output I am getting when issuing the DD command above looks more like this:
fb55 d397 2879 2f55 7653 24a3 c250 14d3
3711 7109 e563 617f ab73 f11a 3469 33bb
Which is obviously not the hash I was expecting so I am hoping someone might be able to help me figure out what I am doing wrong.
Some things to note:
- I am 100% positive that the drive I am selecting in the DD command is the right drive.
- There is only 1 encrypted partition on the drive that spans the entire size of the drive.
- There is no physical / functional damage to the drive which would cause this issue.
- This on an external 1tb drive that is connected via usb 3.0 (I have tried other cables and ports).
- The same DD command worked fine for a test drive that I encrypted using the same parameters that were set for this drive.
