2

I'm referring to system full disk encryption with hidden OS. Objective is to corrupt / damage the encrypted hidden volume the simplest way. Here's the scenario:

I've created system outer (decoy) volume with 500MB buffer and the hidden volume. All required programs running OK. I login outer volume to set CCleaner to wipe drive with pseudorandom (1 pass) on every startup.

Next time, if anyone or myself login outer volume, CCleaner will wipe free space automatically. Say the wipe status goes beyond 1GB free space, will the encrypted hidden volume be damaged? Has anyone tried it, 100% sure?

In theory, it should work though I've not tested it. Also, I've created my own zip bomb that can extract & occupy space up to 3GB in 1min.

Improve this question
3
  • I need to save several hours of testings. Hope anyone who has tried it can respond.
    – desperado
    Mar 27, 2011 at 8:16
  • Just finished testing on 2 different FDE brands. Yes it works. Zip bombing and wiping free space in the outer (decoy) volume kill the encrypted hidden one.
    – desperado
    Mar 31, 2011 at 4:33
  • 1
    Questions on this site are marked solved by the owner (you) clicking the checkmark next to the solving answer (i.e. accepting the answer). The user who answered (grawity) will get a few reputation points as reward. I'll revert your edit.
    – Daniel Beck ♦
    Mar 31, 2011 at 5:19

1 Answer 1

Reset to default
2

Yes, writing over the hidden volume will destroy it. TrueCrypt docs confirm this. Also the fact that TrueCrypt does not know about the volume's existence unless you explicitly tell it at mount-time; that's what the protect hidden volumes option in the "Mount Volume" window is for. I'm not sure whether this can be enabled for the system volume.

As of TrueCrypt 4.0, it is possible to write data to an outer volume without risking that a hidden volume within it will get damaged (overwritten).

When mounting an outer volume, the user can enter two passwords: One for the outer volume, and the other for a hidden volume within it, which he wants to protect. In this mode, TrueCrypt does not actually mount the hidden volume. It only decrypts its header and retrieves information about the size of the hidden volume (from the decrypted header). Then, the outer volume is mounted and any attempt to save data to the area of the hidden volume will be rejected (until the outer volume is dismounted).

Improve this answer
1
  • Just finished testing on 2 different FDE brands. Yes it works. Zip bombing and wiping free space in the outer (decoy) volume kill the encrypted hidden one.
    – desperado
    Mar 31, 2011 at 4:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .