Soldato
Is this relatively easy to set up? Is it possible to mess up the safe OS so you can't access the hidden OS... if you see what I mean?
AFAIK it is relatively straightforward to setup as the TC program does it all for you. Its the using of each OS that has certain caveats which can be found here - http://www.truecrypt.org/docs/hidden-operating-system
I was slightly wrong (just refreshed my memory). Effectively you have a single HDD with 2 partitions. The safe OS is loaded onto partition 1 and the 2nd partition is encrypted separately.
Within the 2nd partition resides the "Hidden OS" (not the whole partition, just part of it). This is separately encrypted from partition 2's encrypted volume i.e. you have 3 encrypted "bits":
1. Safe OS encrypted on partition 1
2. Safe VOLUME encrypted on partition 2
3. Hidden OS encrypted within partition 2
***I will explain the "handing over of passwords for plausible deniability at the end"***
When you boot up your PC, the TC loader will kick in and ask for you OS password:
1.If you put in the "safe password" then it will load up the safe OS from partition 1
2. If you put in the Hidden OS password then it will load up the hidden OS from within partition 2
Now because both OS's exist on separate partitions, they do not interfere with each other and you can faff around without fear of overwriting the other OS (TC makes each of the alternate OS's data regions read only)
I hope this kinda explains how the OS's are separate and are protected from each other?
-------------------------------------------------
Now to achieve plausible deniability, you have to do use your PC in certain ways which are described in the link at the top. The MAIN thing to do is to use your SAFE OS as much as possible for your everyday mundane tasks i.e only use your HIDDEN OS for stuff you want to keep hidden.
The reason for this is because using an OS builds up a whole array of deleted files and file segments through normal everyday use. If you don't use an OS then the OS will look, basically, pristine. This will not fool someone trained in computer forensics as they will look for certain things to be present within an OS as standard.
By using the safe OS as much as possible and only the hidden OS when needed, you build up these elements making it look like you only have 1 OS on the drive.
For the Safe VOLUME (partition 2) - Put some family pictures or other stuff you don't mind sharing with law enforcement but would have "a valid excuse for keeping encrypted in case my PC got nicked".
-------------------------------------------------------------------------
Back to the "handing over of passwords" I mentioned near the start:
Effectively you have 3 passwords now:
1. Safe password 1 for the Safe OS encrypted on partition 1 - used at login
2. Safe password 2 for the Safe VOLUME encrypted on partition 2 - used when logged in to SAFE OS ONLY
3. Hidden password for the Hidden OS encrypted within partition 2. - used at login
The person looking at your PC knows only 2 certain things:
1. You have an encrypted OS on partition 1
2. You have a Truecrypt volume on partition 2
You can safely hand over both "safe" passwords. All this will allow the person to do is access your safe OS (which has no sensitive stuff on it) and also your Safe Volume on partition 2.
The hidden OS is still safe as, when the unlocked Safe Volume is looked at, it will show up as filling the entire partition yet the Hidden OS is still encrypted and will just look like unallocated drive space.
--------------------------------------------------------------------------
Plausible deniability:
Safe OS - "I have this in case my PC got nicked and I don't want people to get at it"
Safe VOLUME - "I keep my personal photos etc in here. It's not on the main OS partition as I need to keep them separate if I ever reinstall my OS"
Hidden OS - Well, this is almost impossible to prove.
meh... tl;dr