3
If I encrypt an entire partition with TrueCrypt (a standard volume, not a hidden volume), would the partition look statistically indistinguishable from random data?
Or would someone be able to prove (possibly using a chi-square test) that the data is indeed not random?
1I think either I'm misunderstanding something or you are misunderstanding something. :-) How is the file size module 512 being zero a sign of a TrueCrypt partition? Aren't all partition sizes mod 512 equal to zero nowadays? Or were you talking about file containers instead? – user541686 – 2012-01-29T00:16:21.497
It will find partitions, embedded files, even TrueCrypt embedded in whole hard drives — even that is proof alone that it's somehow distinguishable. I'm not sure on the algorithmic details exactly, or why that should work, but the fact that it does work is enough for me :) And of course, it will find false positives, e.g. other files with pure random data.
– slhck – 2012-01-29T09:41:41.260For the benefit of others: At the time that I write this, Trend Micro is blacklisting apparently the entirety of 16 Systems' WWW site, and the
16s.us.
hyperlink in this answer leads to a warning page about malware hosting, fraud, or scams on machines with Trend Micro Internet Security installed and running. – JdeBP – 2012-01-29T18:27:26.963I believe this is incorrect. From the TCHunt FAQ: "Note: If the encrypted volumes are hidden among /dev/urandom created files via dd, they will not stand out." – tlrobinson – 2012-07-12T19:04:11.573
@tlrobinson Interesting, good to know – but if it wasn't possible to find those volumes, why would TCHunt exist? – slhck – 2012-07-12T19:06:41.367