2

There is a problem with plausible deniability of TrueCrypt / VeraCrypt which bothers me for quite some time. Since the software must not show any hints about whether a hidden volume exists inside the main volume, how can it decide, how much free disk space is available in the main volume?

  1. Does it just override the content of the hidden volume, when we store too many data in the main volume?
  2. Does the size of the hidden volume change dynamically, when we store more files in the main volume?
  3. Does a fragmented main volume increase the danger of overwriting the hidden volume?
1

The elements are provided on the wiki page on Hidden volume. The outer volume and the hidden volume share the same lower level space, and at creation time, the size of the hidden volume was computed to not overwrite existing data in the normal volume.

But to allow the plausible deniability, nothing in the outer volume can be aware of the existence of a hidden volume when it is opened normally (*). So if you add a lot of data into it, you are likely to overwrite the hidden volume and destroy all of its data.

Said differently, when confidentiality is important, a hidden volume is fine, but not when availability or integrity is the major concern. But even when you know that, using a hidden volume is not a trivial operation. Because you must:

  • use the outer volume on a regular bases to avoid to show that it is never used => which would be an hint that is is only there to contain a hidden volume and would break in piece the plausible deniability
  • never let the system file grow in the outer volume in order not to destroy the inner one (*)

(*) As it would be complex to use the outer volume and at the same time be sure not to damage the hidden one, VeraCrypt offer the possibility to make the outer volume aware that it contains a hidden one through a mount option requiring both passwords. When you use the outer volume that way, you cannot erase the hidden one. But someone looking at your computer at that moment will also know that it contains a hidden volume.

So you must be prepared if you have to reveal the outer volume to only open it in normal mode and use it normally even if it can destroy the hidden volume.

  • I don't know about TrueCrypt, but VeraCrypt has a mounting option to prevent it from damaging hidden volumes. You must provide both passwords though, but if you're going to use your visible partition and don't want to damage the hidden one it's useful – Mr. E Dec 21 '16 at 14:42
  • @Mr.E: Thank you for noticing. I have updated my answer with it. – Serge Ballesta Dec 21 '16 at 14:58
  • Thanks to your answer I finally found this this page, explaining how to protect hidden volumes. With this option, the information about the hidden volume is read and respected when writing to the main volume, without mounting the hidden volume itself. – martinstoeckli Dec 21 '16 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.