2 ms·
Yes, but only if they know there to be an encrypted partition. Because all encrypted data passes a Chi^2 randomness test you cannot (really cannot) distinguish
by gizmo 17y ago
Yes, but only if they know there to be an encrypted partition. Because all encrypted data passes a Chi^2 randomness test you cannot (really cannot) distinguish between empty space on an encrypted partition and a different encrypted partition inside an encrypted partition.
So when they find a drive that passes the Chi^2 randomness test they know there has to be encrypted data on there, so you give them the key and they decrypt the outer ring (which contains nothing important). At that point they're stuck. They suspect there's got to be more to it, but they can't point to anything and say "decrypt this!", because there isn't anything to point to. So technically, they have to let you go. Or so I heard.