Hacker News new | past | comments | ask | show | jobs | submit login

Can this be used to detect TrueCrypt Hidden volumes (the ones it stores in the free space of other TrueCrypt volumes, for deniability purposes)?



From the FAQ:

Q. Can TCHunt locate hidden volumes?

A. Yes. However, TCHunt cannot differentiate between a standard volume and a hidden one.


I took that to refer to volumes that are just stored on a normal filesystem with their hidden bit set, or a dot prepended. If TCHunt could really find the "stored-in-free-space" Hidden volumes, it definitely would be able to distinguish them, or the disclaimer would at least read "TCHunt cannot differentiate between a deleted volume and a hidden one," because that's what it would look like--data in the filesystem without a corresponding inode/MFT entry. Plus, depending on whether or not it is trying to find these deleted volumes, its scanning algorithm would have to be completely different--one just following down the directory tree, the other working across the block device with a resizable window.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: