5

I've heard some fellow geeks (who are always obsessed with computer privacy) talk about how 'amazing' a hidden partition is for privacy. I don't really see the point of all the trouble if I'm not actively engaging in illegal activities on my machine, but for now I'm more interested in rather or not such a hidden partition is as foolproof as these individuals claim; specifically would it really render any law enforcement powerless to do anything.

Without going too deep into the technical factors involved the idea is to have another partition (ie part of the computer reserved to install and run software on) where the partition is both encrypted and not listed in the boot sector, where partitions are usually stored. The net result is a hidden partition, no one can see or access it without using some special boot technique, such as using a CD or thumb drive to change how the computer boots up, to connect to it. if you don't plug in your magic thumb drive before you start your computer then in theory it would be impossible to tell you have another hidden partition or connect to it.

I know enough about computers to know this hidden partition isn't quite as foolproof as claimed, as inferring the existence of a hidden partition shouldn't be impossible on a technical level. The fact that a large part of the computer isn't allocated, effectively preventing use of part of your computer's storage, should be enough to make an analyst at least suspect a hidden partition may exist, doubly so if someone mostly used their hidden partition so that their visible partition was rarely used or too small to be useful. Once a hidden partition is suspected some analysis of 'randomness' of the 1 and 0 on the unallocated space could be used to provide extremely strong evidence that there was encrypted data saved there, with a very large area of encrypted data in turn being very suggestive, but not definitively prove, that a hidden partition is being used.

So say that a suspected criminal, who used one of these hidden partitions, had his computer confiscated. Let's further say the polices' technical folks are on the bar and noticed the evidence which strongly suggests, but could never definitively prove, that the suspect was using a hidden partition. The police would, of course, like to get access to this hidden partition to see if anything incriminating is saved on it, but their going to need the magic thumb drive to view anything saved on it.

I suspect the police could not compel the criminal to hand this over directly, as the evidence, no matter how suggestive, would not be be absolute proof that the hidden partition existed. Though if the police were able to find some other proof of a hidden partition, such as conversations the suspect had with someone where the suspect refers to his use of such a partition, they may be able to meet a sufficient burden of proof to compel the suspect to make the content of the partition available to them?

Would there be any other options that the police may have to deal with such a suspected hidden partition which may contain incriminating data? The two obvious ones I could think of are:

  1. getting a second search warrant to allow them to search for the thumb drive used to connect to the partition. I imagine that they only need reasonable suspicion of a hidden partition to get a more extensive search warrant? Though I doubt that would be too useful since a criminal would presumably destroy such a device immediately after their computer was confiscated to prevent police from getting hold of it?

  2. Could the mere (strongly suspected) presence of a hidden partition be used against the suspect? for instance in a criminal trial could the prosecutor argue the fact that the suspect was apparently going to great lengths to make it impossible to see what he was using his machine for as evidence that the suspect likely was doing something unlawful with the machine?

7
  • 1
    Please note that VeraCrypt and TrueCrypt hidden partitions are impossible to detect without the password.
    – forest
    Aug 14, 2019 at 6:55
  • 2
    @forest for any encryption to be unbreakable it needs to appear random, without patterns. However, regular use of a computer does have patterns, for examples 0 are used far more then 1's and 0 are more likely to be found on the big endian side of a byte and/or word then on the little endian side, owing to the fact that we use 0 as placeholders and tend to work with small numbers more often then large numbers etc. Due to this it should be possible to search for patterns. If you find a lack of patterns and what appears to be truly random bits then your likely looking at encryption.
    – dsollen
    Jan 5, 2021 at 19:55
  • 2
    With VeraCrypt, you may already suspect that it's encrypted, but it's impossible to know if a hidden volume exists "beyond" the outer volume.
    – forest
    Jan 9, 2021 at 21:49
  • @forest I have a 4TB hard drive. It has the manufacturers name, model number, and serial number printed on the case, so police will easily know that it is a 4TB drive. It may be hard or impossible to make any software on the computer admit that it is larger than 3TB, but just looking at the case proves it. So "impossible to detect" is nonsense. It would be obvious that it is a 4TB drive with one TB invisible to the software.
    – gnasher729
    Mar 15 at 15:41
  • 1
    @forest anyone who claims anything about a computer is impossible to detect/recognize/illegitimately access is objectively wrong. You might be able to reach 'beyond the capacity of the police' or even 'beyond the capacity of any organization on earth,' but the simple fact is that while the information is on a computer, it is retrievable. Jul 11 at 22:06

3 Answers 3

5

Though if the police were able to find some other proof of a hidden partition, such as conversations the suspect had with someone where the suspect refers to his use of such a partition, they may be able to meet a sufficient burden of proof to compel the suspect to make the content of the partition available to them?

The US courts have ruled on this, and the answer is "no":

San Francisco - A federal appeals court has found a Florida man's constitutional rights were violated when he was imprisoned for refusing to decrypt data on several devices. This is the first time an appellate court has ruled the 5th Amendment protects against forced decryption – a major victory for constitutional rights in the digital age.

In this case, titled United States v. Doe, FBI agents seized two laptops and five external hard drives from a man they were investigating but were unable to access encrypted data they believed was stored on the devices via an encryption program called TrueCrypt. When a grand jury ordered the man to produce the unencrypted contents of the drives, he invoked his Fifth Amendment privilege against self-incrimination and refused to do so. The court held him in contempt and sent him to jail.

TrueCrypt is one of the forerunners of hidden partition cryptographic tools. The anonymous team behind it closed shop suddenly and unexpectedly in 2014 in mysterious circumstances.

getting a second search warrant to allow them to search for the thumb drive used to connect to the partition.

This is entirely reasonable, as it does not require self incrimination - if the USB key was password protected (as it should be) then you are back to square one.

Could the mere (strongly suspected) presence of a hidden partition be used against the suspect? for instance in a criminal trial could the prosecutor argue the fact that the suspect was apparently going to great lengths to make it impossible to see what he was using his machine for as evidence that the suspect likely was doing something unlawful with the machine?

It would be a very weak argument, if allowed by the court - the defence could equally argue that the partition contains medical information, self taken naked pictures or grand political plans that the defendant does not want to be made public. Both arguments would technically be equal in nature, as the contents cannot be corroborated.

4
  • 2
    According to a separate question of mine the police may be able to force the suspect to provide the content of the hidden partition if they can prove the suspect has access to the data, is this not true?: law.stackexchange.com/questions/1523/…
    – dsollen
    Aug 12, 2019 at 23:07
  • 2
    @dsollen shrug sounds like an end run around the Fifth Amendment to me...
    – user4210
    Aug 13, 2019 at 0:08
  • 1
    @dsollen The linked answer implies that it would have to be a court order. Aug 13, 2019 at 12:26
  • 3
    If the contents are a "foregone conclusion", or you have legal immunity for everything contained in there, there's fewer 5th amendment issues with getting compelled to decrypt. Still rife for abuse though.
    – bobsburner
    Jan 21, 2020 at 13:03
3

There have been several cases with several outcomes. Here’s what I think the current state is:

  1. You never have to produce the password. Unlocking the drive without anyone seeing the password is good enough.

  2. If the mere fact that you can decrypt the drive is incriminating then decrypting it would be self-incriminating and you don’t have to do that.

  3. The police needs a warrant for the data. Which means they need reasonable grounds to believe that there is relevant evidence on the drive. The fact that you were hiding the drive or refuse to decrypt it doesn’t give these reasonable grounds.

  4. If the police has a warrant, and (2) doesn’t apply, you have to unlock it.

  5. In a civil case, if you don’t provide things that are asked for in discovery, a court can assume that what you are hiding speaks against you.

-2

First of all, there is no need to have that "magic" thumb drive to prove that a "hidden" partition exists. A mediocre system engineer can just boot the computer from his own geeky thumb drive and see what partitions there are.

So, it will be pretty easy for the police to prove that there is a partition that is not visible when the computer is booted normally.

But that's all they can prove.

If done properly, it will be impossible to prove that the "hidden" partition contains any encrypted data — versus just being rubbish of zeroes and ones. This is where the owner's "magic" thumb drive is needed together with the knowledge of how to use it (what commands and password to enter). And this knowledge is protected by Fifth Amendment. Even if the police finds this thumb drive, again, it will be impossible to prove that it can be used to open the partition (if made properly).

Obviously, the argument can be "what would be the reason to have such a partition other than to keep encrypted data on it?". But this does not prove that there is encrypted data, let alone unlawful data.

Therefore, rubber-hose cryptanalysis is the only feasible way, be it legal or not.

4
  • 1
    This isn't correct. A hidden partition (in the sense of plausibly deniable encrypted partitions) cannot be seen without the password. They aren't really genuine MBR or GPT partitions.
    – forest
    Aug 14, 2019 at 6:56
  • @forest don't know what specific technology you're talking about, but this answer assumes genuine MBR/GPT partition, say LUKS-encrypted with detached header; you can see it exists but you can't tell whether it is encrypted or just rubbish.
    – Greendrake
    Aug 14, 2019 at 7:41
  • 1
    That's not normally what is meant by "hidden partition".
    – forest
    Aug 14, 2019 at 7:42
  • @forest I look (with my eyes) at the drive, read the manufacturers name, the model name, and the serial number, all printed on the drive, and I know the size of the drive. No thumb drive or anything needed. Worst case for the police, the manufacturer will be able to identify the size of the drive by looking at it or opening it very carefully.
    – gnasher729
    Mar 15 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .