TrueCrypt detection question

Content Authoring
1

(imported topic written by SystemAdmin)

Does anyone here happen to know how to detect if TrueCrypt has been used to encrypt an entire drive? I can detect if it is installed and running as a service, but that is also the case on my desktop where I only use it to encrypt files. I realize it’s not a BigFix question, but I have to detect the condition using BigFix (TEM) for compiling Enterprise reports. Any help would be appreciated. If I find an answer elsewhere, I’ll post it here.

2

(imported comment written by amagewick91)

Check the website for the TrueCrypt. I know that it tells you how it encrypts files, dow n to the bit level, so maybe they will say how they encrypt the entire drive. It might get you where you need to go?

3

(imported comment written by SystemAdmin)

If Truecrypt is being used in “traveler” mode, you probably will not be able to detect it at all. In fact, that is actually one of its features.