I remember this case - absolutely DISGUSTING behaviour by the CPS and police trying to ruin an innocent man's life. If you think you have nothing to hide and the authorities have your best interests at heart, just read the details of this case. They desperately tried to pin anything they could on this guy after the child porn they went looking for on his pc didn't exist.
Plausible Deniability
- Thread starter yhack
- Start date
I remember this case - absolutely DISGUSTING behaviour by the CPS and police trying to ruin an innocent man's life. If you think you have nothing to hide and the authorities have your best interests at heart, just read the details of this case. They desperately tried to pin anything they could on this guy after the child porn they went looking for on his pc didn't exist.
they might be able to write a GUI interface in VB to find your hidden partition....
http://www.youtube.com/watch?v=hkDD03yeLnU
Soldato
Recovering deleted files is possible only IF the physical space on the disc that they occupied has not been written to with another file. Some computer forensics people try to perpetuate a myth that they can recover data which has been deleted AND has since been overwritten again with something else.
Care to say why?
Soldato
edit: I wonder if this thread will turn out like the other one where someone in Computer Forensics was insisting that data could be recovered from a HDD even if it had been fully overwritten and magically increase your HDD space seven-fold... Can't find it now
That was me, and it was increasing space 256 times, 7 times is only with older drives.
I can't believe you've never heard of that capability?
Suspended
Oh, that's a coincidence. So is mine. Who do you work for?
Last edited:
Suspended
He's wrong. A few assumptions people have made are not entirely accurate, but generally most of the information in the thread is pretty spot on.
Suspended
To fully wipe a modern drive, even with a simple overwrite of zeroes, takes hours. I'm not sure what it is that's so valuable you want to keep hidden
Soldato
FTK (Forensic tool kit) can see past these kind of shenanigans, trucrypt or not, there are a number of ways to identify file structure and 'hidden' partitions.
if its on there, it can be read, only in some instances of time critical forensics will they fail to do so.
Link:http://accessdata.com/products/computer-forensics/ftk
if this fails i play some funky drum music, with zoom shots of me looking at your hard drive with narrow eyes, 20 secs later i have the lot off there.
enter Grisham/
if you want to 'secure erase' a drive? 6 inch nail and a hammer, four blows round the disc areas, all good
if its on there, it can be read, only in some instances of time critical forensics will they fail to do so.
Link:http://accessdata.com/products/computer-forensics/ftk
if this fails i play some funky drum music, with zoom shots of me looking at your hard drive with narrow eyes, 20 secs later i have the lot off there.
enter Grisham/
if you want to 'secure erase' a drive? 6 inch nail and a hammer, four blows round the disc areas, all good
Last edited:
Soldato
Is the hidden OS split up into random file chunks as surely a 60GB random file on a disk is pretty much a given what it is being used for if someone is suspecting a hidden OS?
Screw all of this
- Get a plastic cooler casing from a large GFX card and attach it to a small gfx.
- Place a Raspberry Pi inside with a 32gb SD, usb Wifi dongle and bluetooth dongle.
- Connect the Pi to the phono out on the gfx card, for extra security place a small pin-hole latching switch in line with the Pi 5v power input.
- Power the Pi via the 5v pin from a molex connector, made to look like an additional PSU connection for the GFX.
- For audio, discreetly wire up to the green audio out on the back of the main PC motherboard, you can connect both together.
- To turn on simply boot your PC, attach your monitor to the phono video out and use a paperclip to boot the Raspberry Pi.
I see no flaws to this plan.
- Get a plastic cooler casing from a large GFX card and attach it to a small gfx.
- Place a Raspberry Pi inside with a 32gb SD, usb Wifi dongle and bluetooth dongle.
- Connect the Pi to the phono out on the gfx card, for extra security place a small pin-hole latching switch in line with the Pi 5v power input.
- Power the Pi via the 5v pin from a molex connector, made to look like an additional PSU connection for the GFX.
- For audio, discreetly wire up to the green audio out on the back of the main PC motherboard, you can connect both together.
- To turn on simply boot your PC, attach your monitor to the phono video out and use a paperclip to boot the Raspberry Pi.
I see no flaws to this plan.
Soldato
Forensics open computer, notice unusual wiring, find raspberry pi, game over.
Nope, not even the NSA could read a disk that has been zeroed once.
No...
http://www.truecrypt.org/docs/?s=hidden-volume
Truecrypt hidden volumes cannot be detected at all. Neither can a hidden OS as it's just a hidden volume essentially.
Soldato
For the people that say a data can be recovered even if overwritten once, can you explain the following:
Essentially data is 1s and 0s in it's base form. To keep this simple:
If I have data which is in the form "10011001101101" and then I delete it then it is possible this can be recovered. However if this exact sector is overwritten in some way so it now reads "110010001111" then could you explain how you can recover the original data that existed there in the first place?
Essentially data is 1s and 0s in it's base form. To keep this simple:
If I have data which is in the form "10011001101101" and then I delete it then it is possible this can be recovered. However if this exact sector is overwritten in some way so it now reads "110010001111" then could you explain how you can recover the original data that existed there in the first place?
The only wires going to it would be the molex connector for the GFX, you could run the audio/video through the hdmi rather than wiring into the main MB's audio port thinking about it.
Also, you could have a program running on the Pi that formats the SD card and any other storage on it if you don't type in the password correctly on start up, or something like that.
You can't find a hidden encrypted partition. The data is indistinguishable from random data.
There *are* programs which *try* to detect hidden, encrypted partitions.
They have been tested and reviewed. The findings? When fed drives with random data, these programs regularly "found" hidden partitions that *weren't actually there*.
In other words, like an AV program set to aggressive/strict scanning, these programs create far too many "false postitives" to be used as evidence against you.
It would be like a lie detector that would signal a lie 8 times out of 10 when being told nothing but the truth. Absolutely useless.
Soldato
shhh, don't say it so loud that the blinkered forensic computer "geeks" get all upset and implode with consternation at your heresy 
My head hurts using all them there big fancy words
My head hurts using all them there big fancy words