VeraCrypt / TrueCrypt Volume
| Format | VeraCrypt / TrueCrypt Volume |
|---|---|
| Short name | VeraCrypt |
| Category | filesystem |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Encrypted containers and partitions of VeraCrypt and its predecessor TrueCrypt. The volume header is itself encrypted with a key derived from the password (and optional key files/PIM), so a volume has no signature and is indistinguishable from random data; a hidden volume can sit inside the free space of an outer one. The first 64 bytes hold the salt; a hidden volume's header is located at byte 65536, and backup headers encrypted with a different salt are stored at the end of the volume. Indicators are a size divisible by 512, high entropy throughout and the absence of any file signature.
Signatures
None recorded
Known extensions
.hc, .tc
References
- VeraCrypt Volume Format Specification (VeraCrypt) https://veracrypt.io/en/VeraCrypt%20Volume%20Format%20Specification.html
- ForensicsWiki — TrueCrypt https://forensics.wiki/truecrypt/
Cite this entry
Crush Format Reference, “VeraCrypt / TrueCrypt Volume”. https://kalink0.github.io/crush-forensics/formats/veracrypt/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction