Which would you rather go down for: destruction of evidence, or what's in your h...

striking · on March 21, 2017

If someone released such a tool, the feds would make sure to clone your hard drive before supplying the password to it, or write a patched version of the tool that reads it to remove the disk wiping call.

And then you'd be in really hot water.

naasking · on March 21, 2017

I expect cloning to already be standard forensic procedure, but perhaps I'm wrong. If not, it should be.

Kostchei · on March 21, 2017

yep. Work on the copy, or the copy of the copy in my case. It's digital with a hash, not a vhs tape

Overtonwindow · on March 22, 2017

Ah cloning, very good point. So that raises a new question: Is there any way to prevent decryption of a drive, when the password is forcibly obtained?

MaulingMonkey · on March 21, 2017

An interesting talk on disk antiforensics: https://www.youtube.com/watch?v=qZtkANvDxZA

Of course, having watched this, the feds might look for such tricks...