Encrypted disk containers generated by TrueCrypt (and modern successors like VeraCrypt) do not contain detectable headers or magic bytes. The container appears indistinguishable from random noise, protecting against forensic identification.

During forensic investigations or lost credential recovery, if specialized GPU cracking tools (such as Hashcat or John the Ripper) are unavailable, you can audit container passwords using a headless CLI mounting script.

Python Dictionary Testing Script (tc_crack.py)

This script iterates through a wordlist, attempting non-interactive mount commands against the target container file until a successful exit status is returned:

#!/usr/bin/env python3
"""
TrueCrypt / VeraCrypt Automated Container Password Auditor
Author: Ahmad Mahfouz (n1x)
"""

import sys
import subprocess
import os

def audit_container(container_path, wordlist_path):
    if not os.path.exists(container_path):
        sys.exit(f"[-] Container file not found: {container_path}")
    if not os.path.exists(wordlist_path):
        sys.exit(f"[-] Wordlist file not found: {wordlist_path}")

    print(f"[*] Starting dictionary audit against: {container_path}")

    with open(wordlist_path, 'r', encoding='utf-8', errors='ignore') as f:
        for line in f:
            password = line.strip()
            if not password:
                continue

            # Command attempts non-interactive mounting
            # For VeraCrypt, replace 'truecrypt' with 'veracrypt'
            cmd = [
                "truecrypt",
                "-t",
                "--non-interactive",
                container_path,
                "-p", password,
                "--protect-hidden=no"
            ]

            proc = subprocess.run(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)

            if "Error" not in proc.stderr and proc.returncode == 0:
                print(f"\n[+] Password Found: {password}")
                # Cleanly dismount after discovery
                subprocess.run(["truecrypt", "-d", container_path], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
                return True

    print("[-] Finished wordlist. Password not found.")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: python3 {sys.argv[0]} <container_path> <wordlist_path>")
        sys.exit(1)

    audit_container(sys.argv[1], sys.argv[2])

Modern High-Performance Alternative: Hashcat

While CLI automation is portable and requires zero compilation, high-speed recovery on multi-core GPUs should be executed via Hashcat:

  1. Extract the container header: 
    dd if=secret.tc of=tc_header.raw bs=512 count=1
  2. Run Hashcat against TrueCrypt modes (e.g. Mode 6211 for RIPEMD160 + AES): 
    hashcat -m 6211 -a 0 tc_header.raw /usr/share/wordlists/rockyou.txt