Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I encrypt an entire partition with TrueCrypt (a standard volume, not a hidden volume), would the partition look statistically indistinguishable from random data?

Or would someone be able to prove (possibly using a chi-square test) that the data is indeed not random?

share|improve this question

No, it can be distinguished from random data. However, it probably doesn't matter in practice.

There's an interesting article here that explains some of the typical properties of a TrueCrypt container:

  • The suspect file size modulo 512 must equal zero.
  • The suspect file size is at least 19 KB in size (although in practice this is set to 5 MB).
  • The suspect file contents pass a chi-square distribution test.
  • The suspect file must not contain a common file header.

It talks about the program TCHunt, which was specifically designed for finding TrueCrypt containers. One of the properties is that it passes a chi square test. However, the modulo 512 operation gives more clues, and obviously, only passing a chi square test doesn't mean it's totally random data:

Truecrypt volumes, which are essentially files, have certain characteristics that allow programs such as TCHunt to detect them with a high probability. The most significant, in mathematical terms, is that their modulo division by 512 is 0.

share|improve this answer
I think either I'm misunderstanding something or you are misunderstanding something. :-) How is the file size module 512 being zero a sign of a TrueCrypt partition? Aren't all partition sizes mod 512 equal to zero nowadays? Or were you talking about file containers instead? – Mehrdad Jan 29 '12 at 0:16
It will find partitions, embedded files, even TrueCrypt embedded in whole hard drives — even that is proof alone that it's somehow distinguishable. I'm not sure on the algorithmic details exactly, or why that should work, but the fact that it does work is enough for me :) And of course, it will find false positives, e.g. other files with pure random data. – slhck Jan 29 '12 at 9:41
For the benefit of others: At the time that I write this, Trend Micro is blacklisting apparently the entirety of 16 Systems' WWW site, and the hyperlink in this answer leads to a warning page about malware hosting, fraud, or scams on machines with Trend Micro Internet Security installed and running. – JdeBP Jan 29 '12 at 18:27
I believe this is incorrect. From the TCHunt FAQ: "Note: If the encrypted volumes are hidden among /dev/urandom created files via dd, they will not stand out." – tlrobinson Jul 12 '12 at 19:04
@tlrobinson Interesting, good to know – but if it wasn't possible to find those volumes, why would TCHunt exist? – slhck Jul 12 '12 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .