The DMZ

« first day (2933 days earlier) ← previous day next day → last day (1952 days later) »

forest

3:27 AM

7 hours later…

forest

10:10 AM

it.slashdot.org/story/18/12/26/1248222/…

hah

8 hours later…

jdgregson

6:02 PM

How would you go about hiding TrueCrypt files? The goal would be that, even if analysed by a forensics professional, nobody could suggest with confidence that the file is a TrueCrypt/encrypted data storage file.

My current practice, when I have a file several GB in size, is to give it a .mp4 extension, name it after a movie that I'd download, and then store it in a collection of torrented movies. The belief is that most people would encounter it, realize that VLC can't play it, and just think "oh, this must have been corrupted during download." However, a forensics professional would simpl…

Thomas Ward

you underestimate the professionals

they can identify the filetypes by the actual file headers not extension

jdgregson

Yes...

Did you read the second paragraph?

Thomas Ward

> However, a forensics professional would simply scan the files with a script and a report would come back saying "this file says it's an MP4 but it doesn't look like an MP4."

Yes I did, however that's not typically how data carving scripts work :P

jdgregson

By "looks like" I was referring to the headers and actual file structure.

Thomas Ward

the only way to really 'obfuscate' the TrueCrypt files is to encrypt the files thereby changing their data structure in a way that'd not be recognizeable

that remains the same for any files, though.

jdgregson

6:05 PM

Yeah, by default the files would not be recognizable as any standard file. It would look like an encrypted file, which itself would be a tipoff.

Thomas Ward

you're going to have that problem one way or another

jdgregson

The only solution I have thought of is to disguise it as a backup archive. That would make sense to be encrypted and large.

And as a technical professional, it would make sense for me to have various backups.

4 hours later…