TrueCrack: Cracking TrueCrypt Container Passwords Explained

Encrypted containers are meant to keep data safe, but in digital forensics and authorized password-recovery scenarios, investigators sometimes need to recover access to a TrueCrypt volume whose password has been lost or is part of a legal investigation. TrueCrack is a purpose-built, GPU-accelerated brute-force tool designed specifically to crack the password of TrueCrypt encrypted volumes, making it a niche but valuable tool in the Kali Linux forensics and password-attacks toolset.

This article explains TrueCrack from the ground up: how TrueCrypt containers are structured, how TrueCrack attacks them, installation, syntax, real examples, and how it fits into forensic investigation workflows.

What Is TrueCrack?

TrueCrack is a command-line, brute-force password cracker built specifically for TrueCrypt volumes. Unlike general-purpose crackers like Hashcat or John the Ripper, TrueCrack is purpose-built around TrueCrypt’s specific header format and key-derivation scheme, using CUDA (and later OpenCL support in some builds) to accelerate the process on compatible NVIDIA GPUs.

TrueCrypt volumes store a header that is itself encrypted using a key derived from the user’s password via PBKDF2 with a chosen hash algorithm (RIPEMD-160, SHA-512, or Whirlpool) and a large number of iterations. To crack a volume, a candidate password must be run through this same derivation process and used to attempt to decrypt the header — if the header decrypts to valid data (recognizable via known “magic” markers), the password is correct. This makes TrueCrypt cracking computationally expensive, which is exactly why GPU acceleration matters.

Architecture and Internal Working

1. Volume header extraction — TrueCrack reads the first sectors of a .tc container or raw device where the encrypted header lives.
2. Key derivation loop — for every candidate password, TrueCrack computes the PBKDF2-derived key using the selected hash algorithm.
3. Header decryption attempt — the derived key is used to attempt decryption of the volume header.
4. Validation check — TrueCrack checks for TrueCrypt’s known header signature/checksum; if it matches, the password is confirmed correct.
5. GPU parallelization — steps 2–4 are distributed across GPU cores via CUDA, allowing thousands of candidate passwords to be tested in parallel compared to a CPU-only approach.

Installation

TrueCrack is available in Kali’s repositories, though GPU acceleration requires an NVIDIA GPU with CUDA drivers installed.

sudo apt update
sudo apt install truecrack -y

For GPU support, ensure NVIDIA CUDA toolkit is installed separately:

sudo apt install nvidia-cuda-toolkit -y

Verify installation:

truecrack --help

Basic Syntax

truecrack -t <truecrypt_volume> -w <wordlist>

Key flags:

• -t : path to the TrueCrypt volume file or device
• -w : wordlist file of candidate passwords
• -c : charset for brute-force generation (alternative to wordlist)
• -a : hash algorithm to test (ripemd160, sha512, whirlpool) — by default it tries all
• -b : boot mode (for system-encrypted TrueCrypt volumes)

Practical Command Examples

1. Dictionary attack against a TrueCrypt container

truecrack -t /mnt/evidence/encrypted_volume.tc -w /usr/share/wordlists/rockyou.txt

Sample output:

TrueCrack v3.7
Volume: /mnt/evidence/encrypted_volume.tc
Loading wordlist... 14344392 passwords loaded
Testing candidates...
Password found: "recovery2019!"
Time elapsed: 00:42:15

2. Restricting the attack to one key-derivation algorithm

truecrack -t evidence.tc -w rockyou.txt -a ripemd160

3. Brute-force using a custom charset instead of a wordlist

truecrack -t evidence.tc -c "abcdefghijklmnopqrstuvwxyz0123456789" -m 8

4. Attacking a system (boot) encrypted volume

truecrack -b -t /dev/sdb1 -w rockyou.txt

Real-World Use Cases (Authorized Lab Environments Only)

• Digital forensics investigations: Law enforcement or corporate forensic teams recovering access to a legally seized TrueCrypt-encrypted drive as part of an authorized investigation.
• Data recovery for legitimate owners: An organization or individual who has lost the password to their own TrueCrypt container and needs recovery, with proof of ownership.
• Security research: Studying TrueCrypt’s key-derivation strength and demonstrating why weak passwords remain crackable even with strong encryption algorithms.
• Incident response: Verifying whether an encrypted container found on a compromised system used a weak, guessable password.

TrueCrack should only ever be used against volumes you own or have explicit legal authority to access.

Workflow Integration

• Autopsy/Forensic imaging tools → TrueCrack: Extract or image the suspect drive first using forensically sound imaging tools, then run TrueCrack against a copy, never the original evidence.
• CeWL/Cupp → TrueCrack: Generate targeted wordlists based on known information about the volume’s owner (names, dates, organization terms) to improve dictionary attack odds.
• Hashcat comparison: For VeraCrypt (TrueCrypt’s actively maintained successor), Hashcat’s mode 13721/13753 etc. is often preferred since TrueCrack does not support VeraCrypt’s extended KDF iterations.

Performance Optimization

• GPU acceleration provides the biggest speed gain; a CPU-only run can be orders of magnitude slower.
• Narrow the hash algorithm with -a if the header algorithm is known or can be inferred, cutting search time significantly.
• Prioritize targeted wordlists over blind brute force — TrueCrypt’s PBKDF2 iteration counts make exhaustive brute force impractical for anything beyond short passwords.

Troubleshooting

Best Practices and Common Mistakes

• Always work on a forensic copy/image of the evidence, never the original media.
• Document chain-of-custody and legal authorization before attempting any recovery.
• Don’t assume brute force will succeed on strong, long passwords — PBKDF2’s iteration count is intentionally expensive to slow down attacks.
• Combine wordlists with likely personal or organizational terms rather than relying solely on generic lists like rockyou.txt.

FAQ

Does TrueCrack work on VeraCrypt volumes? Not natively — VeraCrypt significantly increased PBKDF2 iteration counts and changed some defaults, so Hashcat is generally the better tool for VeraCrypt containers.

Is TrueCrack fast? Speed depends heavily on GPU availability. Without CUDA acceleration, cracking is CPU-bound and considerably slower.

Can TrueCrack crack any TrueCrypt password? Only if the correct password is present in the wordlist (or within the brute-force charset/length range attempted). Strong, long, random passwords remain effectively uncrackable in realistic time.

Is using TrueCrack against someone else’s data legal? No — it is only legal when you own the data or have explicit, documented legal authorization (e.g., law enforcement warrant, corporate policy with consent).

Summary

TrueCrack fills a very specific niche: recovering passwords from TrueCrypt-encrypted volumes using GPU-accelerated brute force against the PBKDF2-derived header. It’s an essential tool for digital forensics professionals and legitimate data-recovery scenarios, but its effectiveness is entirely dependent on password strength and having the right hardware. Used responsibly and lawfully, it remains a relevant part of the forensic toolkit even as TrueCrypt itself has been succeeded by VeraCrypt.

References

• TrueCrack GitHub repository: https://github.com/lvaccaro/truecrack
• Kali Linux tool listing: https://www.kali.org/tools/truecrack/
• TrueCrypt documentation archive: https://www.grc.com/misc/truecrypt/truecrypt.htm