I have several files on my Ubuntu system, which are LUKS encrypted partitions. For my own shame up to this day I thought that simply changing binary file's extension will be enough to hide what a file really is. I.e. if I rename my LUKS partition stuff
to windows.vdi
then everyone would think that this is a virtual box drive, although corrupted, because an attempt to use it as the extension suggests would have definitely failed.
But today I've known about the file
command, which correctly shows what a file is:
file windows.vdi
windows.vdi: LUKS encrypted file, ver 1 [aes, xts-plain64, sha1] UUID: xxx-xxx-xxx
And the same problem is with other file-types, which I would like to hide, like keepass password files, etc.
Does anyone know any way to hide file's true purpose on a system?
The idea is that in a situation where one can not resist a demand to provide passwords (for instance if he is captured physically and tortured), he should be able to deny the very existence of any encryption just after a computer was shut down, that is without hiding any files in another ones, editing files in a binary editor etc. just because he may not have enough time to do this
file
command looks at the contents of the file. Typically the first few bytes. These are sometimes called the 'magic number'. So you'll need to change those are bytes to hide the from the command..vdi
file and use it to obfuscate your LUKS data, placing your LUKS data after it in the file. Then, to read it properly, you'd have to kill that leading few bytes. It'd be easier to merely usechmod go-rwx windows.vdi
so thatfile windows.vdi
returnsregular file, no read permission
(except to you and root).