According to the documentation a hidden volume stays hidden because it appears as free space. In TrueCrypt free space always has random data in it, however in the case of a hidden volume it's not actually random data but the hidden volume. I was wondering how is it possible to write (for example add a new file) to the outer volume with out risking overwriting the hidden volume?
As of TrueCrypt 4.0, it is possible to write data to an outer volume without risking that a hidden volume within it will get damaged (overwritten).
When mounting an outer volume, the user can enter two passwords: One for the outer volume, and the other for a hidden volume within it, which he wants to protect. In this mode, TrueCrypt does not actually mount the hidden volume. It only decrypts its header and retrieves information about the size of the hidden volume (from the decrypted header). Then, the outer volume is mounted and any attempt to save data to the area of the hidden volume will be rejected (until the outer volume is dismounted).
Wouldn't this make it easy for an attacker to learn there is a hidden volume? As soon as he can't write to free space he'd know.
For example if an outer volume is created of 5 GB and an inner volume is created with 4 GB. An advisory forces the owner to reveal the password but is given the decoy password to the outer volume. Then the attacker wouldn't be able to write more than 1 GB (at the most) before seeing that there's a hidden volume.
Do I understand this correct? Is this a concern or is there a safeguard against this? Does it help to make the outer volume large so the chances of writing to the free space with the inner volume are low. If one was going to store a virtual machine in a hidden volume, that would take up quite a bit of space. It would be quite consuming to double this size by giving lots of room to the outer volume.
Also, what kind of "fake" sensitive files should go in the outer volume? If you think about it, it's not that easy to make fake confidential looking documents. You wouldn't be able to store any online passwords because they could be verifies as false easily.