Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My biggest fear just got real, police invaded my home and took all my computers, drives, laptops and phones.

I keep all sensitive information inside a truecrypt container, but my laptop was in sleep mode when they arrived. I'm afraid I didn't dismount my drive but hope that they don't take it to the research department for a while so my battery dies.

If that happens and they have to reboot my laptop, the truecrypt drive is dismounted, right?

I live in Belgium so waterboarding and the likes are out of the question :)

It's a very low profile case, let's say I ordered something illegal on silk road and they got the package. A couple months ago they asked to do a search without warrant and I sent them away, I guess they're taking it to the next level now.

I really wonder how deep they will dig, they can't waste that much resources on such a small case right? Will they really try to crack the 256 bit AES? They took 3 computers, 1 android phone and 7 iphones, it would take months to cover all that material

share|improve this question

I'm a forensics undergraduate, and as such I'm reasonably familiar with the procedures police use to deal with systems. Unless there's a specific possibility that there's something encrypted that they're aware of, or they suspect you use FDE, they should, in terms of best practices (the ACPO guidelines are a good overview), unplug your system. They're also supposed to work on a copy of your drive to avoid contaminating evidence. I do distinctly recall truecrypt dismounts on reboot, and can be configured to dismount when in powersaving mode - this is a scenario covered in the truecrypt manual. Its somewhat too late for that now

However, even if they did pull the hard drive, in many civilised places courts can compel you to provide a password to an encrypted folder. In many uncivilised places they can use other means, as this XKCD comic illustrates.

enter image description here

I suppose cracking your password on a massive cluster could happen, but I've not heard of any such convictions yet.

Unfortunately, these are also the same places where they're unlikely to follow best practice. Your milage may vary depending on the procedures of the local law enforcement agency

share|improve this answer
Especially relevant to court cases compelling people to provide passwords, especially in the US:…… But we aren't really discussing legalities on this site. – Bob Jun 7 '13 at 3:37

TrueCrypt volumes are decrypted on the fly when mounted. If your laptop battery dies, the decryption key will start decaying from RAM for like 5 minutes. Then it will be unrecoverable.

That's why police is instructed not to unplug any devices when invading suspect houses. Apparently not all policemen have this knowledge.

share|improve this answer
Actually no. I'm a forensics undergraduate, and standard procedure in most cases involves unplugging the PC, and working on the drive offline to prevent evidence contamination. Only if you're certain that there's encrypted information on the system do you work online. – Journeyman Geek Jun 6 '13 at 10:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .