Updated Cryptoscan and the Volatility Framework

Описание

This video presents how to use updated version of Cryptoscan, a module for recovering TrueCrypt's passphrases from a memory image, on Windows XP SP3.

The video goes into installing TrueCrypt, creating a memory image using MoonSols DumpIt, creating and subsequently mounting an encrypted volume, and eventually recovering the passphrase.

For more information and the code visit the author's blog at
http://passionateaboutis.blogspot.com/2011/10/updated-cryptoscan-for-volatility.html

The presentation slides that accompanied this video are available at
http://passionateaboutis.blogspot.com/2011/10/memory-forensics-presentation.html

PS. Sorry for the bottom black stripe, I turned the full screen off while recording and then forgot to turn it on back again.