In theory it is impossible to prove the existence of the hidden volume by itself once it is closed, and if there is no proof of it's existence our deniability is maintained.
But the issue is that we have more variables that we also need to keep under control, on the Host OS side you have system logs, kernel logs, the various other non-standard log files that software is writing on the disk, and even the content of the RAM itself can be used to prove the existence of a hidden volume.
-<<<<<<< HEAD
Now when you are using your computer for regular public, private and anonymous activities, normally you don't need to care about those things. But the Host OS is a potential goldmine of forensic evidence to be used against you, so for sensitive use specifically we need to take care of it.
Now you could start to manually erase all logs, all kernel logs, all non-standard system logs, manually overwrite the RAM contents, but this is going to be way too tedious and you're likely to miss something. So we have one simple solution: use the Host OS in live mode.
-=======
-Now when you are using your computer for regular public, private and anonymous activities, normally you don't need to care about those things. But the Host OS is a potential goldmine of forensic evidence to be used against you, so for sensitive use specifically we need to take care of it.
-Now you could start to manually erase all logs, all kernel logs, all non-standard system logs, manually overwrite the RAM contents, but this is going to be way too tedious and you're likely to miss something. So we have one simple solution: use the Host OS in live mode.
-TODO: graph (regular host OS writes on system disk, and has contents in RAM, while live mode host OS does not write on system disk, and has everything in RAM)
->>>>>>> 3d6d6e34a194e917e89381ed7f817e2e454904a7Thanks to live mode, we are able to load the entire Host OS in RAM directly, allowing us to avoid writing anything on the system disk (no system logs, no kernel logs, no non-standard logs, only ram contents to worry about)
And since everything is loaded inside the RAM, all we need is to reboot the computer to wipe all of the RAM contents, effectively erase all forensic evidence (and all potential forensic evidence) of the existence of the hidden volume in one simple action.