Is there any full disk encryption out there that does not have any forensic traces? Any effective method?

Question

I've been testing quite a number of full disk encryptions but still new in computer forensic stuffs. I'm fully aware of decoy/hidden OS and cold boot attack though.

Even Truecrypt and Bestcrypt contain traces in the header, bootloader or MBR. Thus, this will raise suspicion and put you into complication like forcing you into giving password and so on. Some people had attempted to remove or modify the traces but ended up with damaged encrypted partition/volume.

Is there any effective method?

How did FBI know the suspects using Truecrypt?

Modify TrueCrypt Encryption Boot Loader Strings

Answer 1

http://www.truecrypt.org/docs/?s=plausible-deniability

Until decrypted, a TrueCrypt partition/device appears to consist of nothing more than random data (it does not contain any kind of "signature"). Therefore, it should be impossible to prove that a partition or a device is a TrueCrypt volume or that it has been encrypted (provided that the security requirements and precautions listed in the chapter Security Requirements and Precautions are followed).

When formatting a hard disk partition as a TrueCrypt volume (or encrypting a partition in place), the partition table (including the partition type) is never modified (no TrueCrypt "signature" or "ID" is written to the partition table).

There are methods to find files or devices containing random data (such as TrueCrypt volumes). Note, however, that this should not affect plausible deniability in any way. The adversary still should not be able to prove that the partition/device is a TrueCrypt volume or that the file, partition, or device, contains a hidden TrueCrypt volume (provided that you follow the security requirements and precautions listed in the chapter Security Requirements and Precautions and in the subsection Security Requirements and Precautions Pertaining to Hidden Volumes).

Other than inventing an invisible hard drive, this is as good as it gets.

Answer 2

If you are talking about an external hard drive containing a TrueCrypt Volume, then as cited in Moab's answer this shouldn't be distinguishable from a drive containing an un-formatted partition. Forensics would basically only know "it looks like random, so there is a real-world chance of XX percent that it is encrypted" ;-). I'd personally assume that XX>80.

However, if you want a full computer system to be bootable and encrypted, there is no way this could be completely untracable, since it needs to contain the computer code doing the decryption algorithm somewhere in unencrypted form; so if the attacker disassembles the boot loader and whatever code it calls, he/she will inevitably find out if any encryption is being used!

An exception would be if you had your decoy system installed with a normal boot loader and only access your TrueCrypt system using the Rescue Disk which contains the TrueCrypt Boot Loader. Of course you must not let the attacker find out that you own a TrueCrypt rescue disk, so you only moved your problem to a smaller, possibly more easily hidable storage device. If you want to go one step further, you re-download TrueCrypt every time you need it, create a Rescue Disk for booting and then erase it and all its traces afterwards ;-).