The Gibson Research Corporation (GRC) website is offering the following page with links to download Truecrypt 7.1a.
My question is, can these downloads be trusted? Is there a way to identify if the downloaded programs have been modified from the original 7.1a release?
They offer a link to another site with the hashes of all Truecrypt 7.1a files, but how can we know if we can trust this site too?
I don't think this is the same as asking can you trust driver download websites? because the history behind Truecrypt is rather unique and the original developers of the software removed the links to the 7.1a version and now offer only a download to a cut down version of the software that doesn't encrypt volumes. The GRC website has stepped in to provide downloads to the 7.1a version, which they still argue is still fully functional and secure. This question is to address how can we trust these claims.