Mueen Nawaz <m.n### [at] ieeeorg> wrote:
>         If he navigated to the directory where it was mounted recently, that'll
> show up in the history, and may give clues to its content. This will
> give them a strong indication that there is a TC volume somewhere, and
> they could ask him about it.

  Just because you have navigated to a directory doesn't mean the directory
was a TrueCrypt mount. It could have been anything.

  After you unmount from TrueCrypt you could execute a "rm -rf *" inside
that directory (so that that command is stored in your command history)
and simply say that you deleted all the files from there.

> >>         Or they could look to see if you have truecrypt installed.
> > 
> >   Still doesn't prove that you have encrypted files. You could simply say
> > that you installed it a long time ago just to see how it works, or whatever.

>         Won't work if you navigated into it recently (command history).

  Starting TrueCrypt does not prove you have encrypted files. Besides,
command histories can be easily deleted, if you are so worried about them.

> >   Then use FAT? What's the problem?

>         Not obvious to folks on Linux that they shouldn't use ext3 on a TC
> volume. Last I checked, the docs didn't imply additional security if you
> use FAT.

  Last I checked, the TrueCrypt documentation clearly stated why you should
use FAT as the file system, and why it is the default when nothing else is
specified.

> >   AFAIK TrueCrypt puts random garbage at every free block for the precise
> > reason that it's impossible to tell whether it's just that, random garbage,
> > or a hidden partition.

>         Yes, but I think you miss my point. Or I don't understand how things
> are stored on the HD.

>         The area occupied by the hidden partition will have random stuff  in
> it, but will appear to be "free" space by the FS (as in space available
> for writing). A contiguous block of 10 GB, especially with actual data
> around it, will look suspicious. Regardless of whether that space has
> random data.

  What do you mean "actual data"? Of course all the sectors will have "data".
The ones which are free will have random garbage (or a hidden volume).
  There's no way of telling if that data is just random gargabe or something
else.

>         It's as if you just deleted 10 GB worth of contiguous material.
> Possible, but not likely.

  How about you simply created the volume and added some files to it?
The rest of the volume will be unused.

> Of course, they can't *prove* anything with what I'm saying. And if you
> think you could get into real trouble, it is of course better to just
> deny. However, there is a risk in lying, and if you really don't have
> much to hide, that risk can be quite high (at least in the US - say when
> you're crossing the border).

  Well, good luck for them to prove that you are indeed lying.

-- 
                                                          - Warp

Post a reply to this message