How much effort are you willing to go through to hide its presence?
Because there are a lot of anti-forensic techniques with varying complexities.
@jdgregson Not only would it look like random data, but it would be in multiples of 512 bytes, which is another giveaway for TrueCrypt/VeraCrypt volumes.
Anyway one common technique is to just use an encrypted external drive. It's very easy to pass it off as simply having been wiped, since it looks indistinguishable from a wiped drive. That's a lot easier to pass off than a strange blob of data in a file.
As far as data security is concerned, the partitions are almost meaningless. If you're trying to prevent forensics from reading your data, then it won't matter. If you've run a proper multi-pass shredder over the data, then the partitions will only matter if you named them something telling.
Add...
For anyone who wants to downvote a crappy answer repeating the old myth that you need to wipe a hard drive multiple times to be sure of data erasure.
Anonymous
3:07 AM
@forest lol. I am so mad right now.
Anonymous
I went to bed at 22:00 to get an early night, slept for an hour and a half, woke up and I've been awake since 23:30~ and I can't sleep now.
I have this bash script and I had a problem in line 16.
How can I take the previous result of line 15 and add
it to the variable in line 16?
#!/bin/bash
num=0
metab=0
for ((i=1; i<=2; i++)); do
for j in `ls output-$i-*`; do
echo "$j"
metab=$(cat $j|grep EndBuffer|awk...
And one more thing regarding Command and Arguments: I read that Command and it's arguments are separated by a whitespace that means first word is command and rest are it's arguments Then why `ls -la` and `ls -l -a` are same? Shouldn't BASH interpret `l` and `a` as different arguements?
I mean when we write -la then BASH shouldn't consider it as one argument?
It sees it as one argument but parses it into multiple ones. A general convention is that a single dash means that any letters that follow are their own flags, so -abc is equivalent to -a -b -c. By convention, a double-dash means it's a "long flag", and the entire thing is taken as an argument, so --verbose is one single flag.
It's really all by convention. You could make it like Windows and accept /? instead of --help if you wanted. In fact some programs don't even need to use a dash, for example tar cf file.tar /some/directory where cf is the same as -cf.
@RoryAlsop Well, not really at least for me I mean I started from C, after that, languages like:- Python, PHP, JS was easy to grasp And the thing is there is a *lot* to learn in BASH (all commands, globs, regex, special chars, expansion etc.) Unlike other languages which are pretty straight forward in which you have to just learn the syntax for conditionals, loops, functions, arrays etc
@RoryAlsop That's true, but I would also have some degree of plausible deniability. If pressed for the encryption key, I could say something like "I don't know what key the program used to encrypt the data. It probably asked for a password and I would have given it **** or *******. I don't even remember what program I used."
How much can you compel someone to divulge information that you can't prove they have? But I suppose they'd answer that question behind the doors of Guantanamo...
@jdgregson all depends on threat model. If government eg UK or US want to, they can hold you under terrorism laws if you don't divulge (even if you have forgotten) - ie guilty until proven innocent!
@forest That's a good idea. And if the file is < 4GB, it would be fairly easy to use an old 4GB MicroSD card which isn't that useful for anything else these days.
@RoryAlsop And supposing I did eventually cave and divulge the key, how easy is it to detect that there is still a hidden volume in the TrueCrypt volume? That question has always bothered me.
@RoryAlsop Thanks, I'll give those a read when I have some time.
On a non-related note, does anyone know much about BitLocker To Go? I use it to encrypt a high-capacity SD card. I'm sure it gives a reasonable level of security, but since it doesn't rely on a TPM, it's much less secure than the main boot drive. However, I have found zero technical documentation on how it actually works, and very little consumer-oriented information. MS is basically like "it's BitLocker for thumb drives. Here's more on BitLocker..."
I have this bash script and I had a problem in line 16.
How can I take the previous result of line 15 and add
it to the variable in line 16?
#!/bin/bash
num=0
metab=0
for ((i=1; i<=2; i++)); do
for j in `ls output-$i-*`; do
echo "$j"
metab=$(cat $j|grep EndBuffer|awk...
