3 ms·
It's still valid if the entire volume is encrypted that way, aka the disk is 100% random data, then nothing will stand out. The volume might have been deleted b
by zobzu 15y ago
It's still valid if the entire volume is encrypted that way, aka the disk is 100% random data, then nothing will stand out.
The volume might have been deleted by dd if=/dev/urandom of=/dev/sdb (for example) in order to wipe the data and make recovery harder. It's common practice (except you usually want many passes).
This is also possible to do on a single partition.
Note that this does not mean that TC is undetectable in any way.
This only means, that the theory behind the concept is perfectly viable and correct - unlike what you are suggesting.