Tales from the Crypt: TrueCrypt Analysis
- Hal Pomeranz, Deer Run Associates
- Thursday, October 17th, 7:15pm - 8:15pm
What if you suspect a device you are investigating may contain TrueCrypt volumes? What if you have no passwords or memory image to analyze and cannot access the volumes? Is all hope lost?
Based on real-world investigations, this talk starts by covering techniques for detecting TrueCrypt volumes on Windows systems using a combination of specialized tools, registry forensics, and application-specific configuration files. Next we'll look at the information that is available to the investigator about the contents of a TrueCrypt volume, even when the volume itself cannot be decrypted.
The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:
- SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
- Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
Monday, October 14
Tuesday, October 15
|An Introduction to PowerShell for Security Assessments||James Tarala||Tuesday, October 15th, 7:15pm - 8:15pm||SANS@Night|
|The Security Impact of IPv6||Johannes Ullrich||Tuesday, October 15th, 8:15pm - 9:15pm||SANS@Night|
Wednesday, October 16
|Hacking as an Act of War||G. Mark Hardy||Wednesday, October 16th, 7:15pm - 8:15pm||SANS@Night|
|Introducing the CompTIA CASP Exam||Seth Misenar||Wednesday, October 16th, 8:15pm - 9:15pm||SANS@Night|
|Detecting Compromised Hosts Using OHIDS||Tom Webb||Wednesday, October 16th, 8:15pm - 8:55pm||Special Events|
Thursday, October 17
|GIAC Program Overview||Dr. Eric Cole||Thursday, October 17th, 7:15pm - 7:45pm||Special Events|
|Tales from the Crypt: TrueCrypt Analysis||Hal Pomeranz, Deer Run Associates||Thursday, October 17th, 7:15pm - 8:15pm||SANS@Night|
|SANS Technology Institute Open House||Dr. Eric Cole||Thursday, October 17th, 7:45pm - 8:15pm||Special Events|