Merely Cloaking Data May Be Incriminating?

n0g writes "In a recent submission to Bugtraq, Larry Gill of Guidance Software refutes some bug reports for the forensic analysis product EnCase Forensic Edition. The refutation is interesting, but one comment raises an important privacy issue. When talking about users creating loops in NTFS directories to hide data, Gill says, 'The purposeful hiding of data by the subject of an investigation is in itself important evidence and there are many scenarios where intentional data cloaking provides incriminating evidence, even if the perpetrator is successful in cloaking the data itself.' That begs the question: if one cloaks data by encrypting it, exactly what incriminating evidence does that provide? And how important is that evidence compared to the absence of anything else found that was incriminating? Are we no longer allowed to have any secrets, even on our own systems?"

But Comrade...

[ObsessiveMathsFreak]

If you have nothing to hide, then you have nothing to fear!

Re:Other types of cloaking...

[AuMatar]

No, they're just cloaking the replies.

A real cloaking device??

[fonik]

And with how quickly my posts are being modded up/down, I could use the polarity change as a new source of clean energy!

Slashdot is truly the breeding ground of new technologies.

Encrypt random noise. Lose the keys.

[MikeFM]

I encrypt everything just so if they ever investigate me, for whatever stupid reason they might decide to, they can demand the key and I can refuse. It's the principal of the thing. Why should we give up our privacy? What if I just want to encrpyt files by a random one time key and then erase the key? Maybe that constitutes digital art to me.

I encourage everyone to generate files containing nothing but random noise, encrypt those files, and throw away the key. If everyone does this then they can't tell what is a real encrypted file and what isn't. For good measure email some of these random files back and forth with suspicious subject lines.

Re:Why even ask?

[UbuntuDupe]

Hey, *I* didn't encrypt my data. I just performed a reversible transformation on it. It's not my fault if you're a fuckin' slowpoke at factoring large prime numbers!

Re:Easy solution

[a_nonamiss]

Why go to all that trouble? If my understanding of TC is correct, shouldn't you just need a hidden partition within a regular one? I thought the whole thing about the hidden partition is that it can't be mathematically proven to even exist. I mean, if you have empty space in a TC partition, it will be indistinguishable from random data. Some of that random data could feasibly be the super secret stuff you're trying to hide, and without a key, there would be no way to prove it.

Man, if that's not true, I think many slashdotters will have to rethink how they hide their porn from their wives... Ok, from their mothers.

It works like this...

[ignavus]

It works like this...

The government, being a public institution, has to keep everything it does private. That's why you are not allowed to see their secret files.

But a citizen, being a private individual, has to keep everything they do public. That's why the government must be able to see your secret files.

Got it?

Re:Other types of cloaking...

[Hal_Porter]

ZFS is ok IMO. But if people use ReiserFS they are probably murderous terrorists.

Re:Encrypt random noise. Lose the keys.

[Maniac-X]

Ideas for suspicious subject lines: "Someone set up us the bomb, praise allah!" "bomb plan" "Pentagon destruction" etc

Re:Guilty until proven innocent

[Anonymous Coward]

Pleading the fifth in front of a jury when you're the defendant is tantamount to an admission of guilt.

Heh, glad you're not my lawyer. :)