TCHunt is a command line tool which can help you find TrueCrypt volumes - regular, sparse or encrypted hidden - on a hard drive. It won't help you to find the password or decrypt them, but just knowing that they exist will let you know that a user of that system may have something to hide. Or, if you use TrueCrypt yourself, it might be interesting to see how easy your own volumes are to detect.

TCHunt doesn't require any installation, you can just download and run it.

The simplest way to start is to point the program at the drive you need, like:

tchunt -d c:\

...and anything dubious will be highlighted as a "suspect_file".

This does produce a fairly detailed report, though, including information like files TCHunt couldn't access for whatever reason. Once you see what it's doing, use this command instead:

tchunt -d c:\ 2>nul

...and you'll only see the list of suspect files (if there are any).

Please note, the developer says that TCHunt can produce false positives. In our tests this didn't happen once, but it can't be ruled out, so take its results as a general indicator only. If the program highlights something you'll need to investigate this further yourself.