Register now for SANS Cyber Defense Initiative 2016 and save $400.

Baltimore 2013

Baltimore, MD | Mon, Oct 14 - Sat, Oct 19, 2013

Tales from the Crypt: TrueCrypt Analysis

  • Hal Pomeranz, Deer Run Associates
  • Thursday, October 17th, 7:15pm - 8:15pm

What if you suspect a device you are investigating may contain TrueCrypt volumes? What if you have no passwords or memory image to analyze and cannot access the volumes? Is all hope lost?

Based on real-world investigations, this talk starts by covering techniques for detecting TrueCrypt volumes on Windows systems using a combination of specialized tools, registry forensics, and application-specific configuration files. Next we'll look at the information that is available to the investigator about the contents of a TrueCrypt volume, even when the volume itself cannot be decrypted.

Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
  • Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
Monday, October 14
Session Speaker Time Type
General Session - Welcome to SANS Dr. Eric Cole Monday, October 14th, 8:15am - 8:45am Special Events
APT: It is Time to Act Dr. Eric Cole Monday, October 14th, 7:15pm - 9:15pm Keynote
Tuesday, October 15
Session Speaker Time Type
An Introduction to PowerShell for Security Assessments James Tarala Tuesday, October 15th, 7:15pm - 8:15pm SANS@Night
The Security Impact of IPv6 Johannes Ullrich Tuesday, October 15th, 8:15pm - 9:15pm SANS@Night
Wednesday, October 16
Session Speaker Time Type
Hacking as an Act of War G. Mark Hardy Wednesday, October 16th, 7:15pm - 8:15pm SANS@Night
Introducing the CompTIA CASP Exam Seth Misenar Wednesday, October 16th, 8:15pm - 9:15pm SANS@Night
Detecting Compromised Hosts Using OHIDS Tom Webb Wednesday, October 16th, 8:15pm - 8:55pm Special Events
Thursday, October 17
Session Speaker Time Type
GIAC Program Overview Dr. Eric Cole Thursday, October 17th, 7:15pm - 7:45pm Special Events
Tales from the Crypt: TrueCrypt Analysis Hal Pomeranz, Deer Run Associates Thursday, October 17th, 7:15pm - 8:15pm SANS@Night
SANS Technology Institute Open House Dr. Eric Cole Thursday, October 17th, 7:45pm - 8:15pm Special Events