4 ms·

I hope linking to reddit doesn't get me banned, but this question was asked there and explained nicely: http://www.reddit.com/r/netsec/comments/1va904/truecryp

• MichaelGG 13y ago
  So it's not the actually the key that's easily located, but the key schedule from which you can get the key out easily?
  • attrc 13y ago
    Yes for projects like aeskeyfind For Volatility we use the TC data structures in memory to lead us to the key (the same ones TC uses to perform reads/writes)