I have a HDD which I encrypted few years ago but I can't remember the tool I used. How can I find out if I have used TrueCrypt or VeraCrypt to encrypt my hard drive?



Neither VeraCrypt nor TrueCrypt have a header or signature that would allow you to detect which encryption was used. So you just have to determine if that particular tool can successfully decrypt your data by trying.

| improve this answer | |
  • Thank you. But I used a hex editor. I saw the string "VeraCrypt Bootloader" in the first bytes of the hdd. – user3646958 Apr 30 '18 at 17:42
  • These links refer to the format of the containers created by these tools and not the format of a volume based encryption created by these tools. – WMIF May 2 '18 at 0:01

This all depends on how exactly you created the encrypted data. When you use 'full disk encryption' you are really using volume encryption. The disk structures are still in place (master boot record, volume boot record, and sometimes the file system). The data inside the volume is where the encryption is applied.

If you used TrueCrypt or any of its variants, you had an option to create an encryption container. This option creates a file, similar to a zip file, on an already established file system. That file system can also be encrypted.

If you plug the disk in and you see folders with a big file, then you likely used a container. If instead you get a message of an unrecognized volume and possibly a prompt to format the disk, then you might have used volume based encryption (full disk encryption).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.