Mueen Nawaz <m.n### [at] ieeeorg> wrote:
>         Well, perhaps if you're just looking at that file. If you're on Linux,
> one often just has to look at your history file to see if you use the
> truecrypt command.

  That may give them a hint that you might have encrypted files in your
system, but they have no way of knowing which ones they are. TrueCrypt
itself leaves no history anywhere.

>         Or they could look to see if you have truecrypt installed.

  Still doesn't prove that you have encrypted files. You could simply say
that you installed it a long time ago just to see how it works, or whatever.

>         Or they could look to see if you have unmounted truecrypt directories.
> I tried it and at least on my computer, truecrypt doesn't automatically
> delete those directories.

  You can choose whatever directory names you want to mount a TrueCrypt
file system. Just use /tmp/tmp/ or whatever. Nothing suspicious about that.

  And as I said, TrueCrypt leaves no history anywhere about what you have
mounted or unmounted.

>         I think under certain circumstances, truecrypt leaves stuff around in
> the /tmp folder.

  It shouldn't leave anything if it works as advertised.

>         As for hidden partition, I don't know the details. I believe an
> analysis was done and they only guaranteed true hiddenness if you used
> FAT as the filesystem of the hidden partition. More precisely, it was
> shown that if you use ext3, there will likely be data elsewhere on the
> HD that will hint that there is a hidden partition somewhere.

  Then use FAT? What's the problem?

>         There are other analyses. Let's say you make your "outer" TC partition
> 30 GB. And inside it you make your hidden partition 10 GB. I read
> somewhere that TC makes that 10 GB block contiguous. So when you give
> the password to your outer TC, if they look they'll see that your data
> (if you have enough of it), will be all over that 30 GB except for this
> big block of 10 GB which has random data (which, to the FS, appears to
> be free space). Now you could say that you just deleted a 10 GB file,
> explaining that big unused contiguous block, but...

  AFAIK TrueCrypt puts random garbage at every free block for the precise
reason that it's impossible to tell whether it's just that, random garbage,
or a hidden partition.

-- 
                                                          - Warp

Post a reply to this message