4 ms·
I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing." More inte
by SoftwareMaven 15y ago
I think that's where forensics would come in: "This is a 2TB drive. All the data on the drive amounts to 1.5TB. QED, there is 500GB of data missing."
More interesting, IMO, would be how alleged steganography would be handled.
- burgerbrain 15y agoThankfully that is not how truecrypt works. The volume would be reported as the full 2TB (or however large the container is), it is up to you to not use all the space (which you could do, it will just silently start overwriting the hidden volume. They would have nothing to go on other than you didn't fill the disk (who does?).
- pixdamix 15y agoWhen writing a byte, how does truecrypt knows it isn't overwriting a random file in a hidden volume ?
- true_religion 15y agoIt doesn't. Essentially, you have to make sure that you don't fill up the volume space or else you will overwrite the hidden volume.
- pixdamix 15y agoSo, if my volume size is 100G on a 200G drive, I have 80G of data, If I write another byte, how Truecrypt knows it won't overwrite one byte of the hidden volume ?
- jbri 15y agoIt doesn't. If you write anything to the non-hidden volume while you don't have the hidden volume mounted, you risk overwriting part of the hidden volume.
- pixdamix 15y agoNow, I got it, You have to mount both the hidden volume and the first level volume to safely write to the first level. Great.
- mahyarm 15y agoNo, since people everywhere don't use the full capacity of their hard drives. Hidden volumes look no different from empty space so that doesn't prove anything.
- deleted 15y ago[deleted]