In what context is there Deniability ?
-
With this setup, you have deniability the moment that the script finishes running, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs. Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after the wipe.sh script finished running.
+
With this setup, you have deniability the moment that the script finishes running, regarding the existance of the veracrypt hidden volume, and the whonix sensitive VMs. Meaning that it is impossible for an adversary that seizes your computer to prove the existance of the Whonix Sensitive VMs after shutting down the Host OS.
+
Below is all an adversary will be able to see, if he were to seize your laptop after you manage to shut it down:
+
Of course, if you are ever forced to, ONLY give your decoy password to the adversary. The existance of the hidden volume, and of the secret password thats used to reveal it must remain a secret at all costs, it must remain known only by you.
If you are ever dragged into court, the judge will appreciate much more if you actually hand over your laptop, and show that you are willing to cooperate with the authorities by providing your password to unlock it, rather than starting to pretend you forgot your password (which can end badly like in this court case, where the defendant was found to be in contempt of court, and thrown in jail for 6 months for it).
If ever asked by the authorities on why you used veracrypt in your laptop, you can simply claim that it was to put your stash of adult content in it. Nothing incriminating about it, and it is plausible given that you dont want that laying around on your desktop, due to being of a private matter.
diff --git a/opsec/veracrypt/index.html b/opsec/veracrypt/index.html
index 34ad37e..b9e343a 100644
--- a/opsec/veracrypt/index.html
+++ b/opsec/veracrypt/index.html
@@ -119,16 +119,16 @@ regarding wear leveling:
→ veracrypt
-
So now that you have veracrypt installed, before you start to use veracrypt, you need to be aware of the lack of deniability you have when using the Host OS in regular mode:
+
So now that you have veracrypt installed, before you start to use it, you need to be aware of the lack of deniability you have when using the Host OS in regular mode:
-
By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you manually remove each of those manually, you're never sure of wether or not Host OS saved proof of the existence of the hidden volume onto the system drive. That's why you need to use the Host OS in live mode, to be able to use veracrypt.
+
By default, your host OS directly writes into the system drive all sorts of potential forensic evidence that an adversary may use against you, such as system logs, kernel logs, non-standard logs, etc, and unless if you remove each of those manually, you're never sure of wether or not the Host OS saved proof of the existence of the hidden volume onto the system drive. That's why you need to use the Host OS in live mode, to be able to use veracrypt.
That way, as you're loading the entire host OS in the RAM due to being in live mode, you are not writing anything on the system drive anymore, but rather only writing all that potential forensic evidence of the veracrypt hidden volume in RAM alone, which can be easily erased with a simple shutdown.
So now that we have installed veracrypt, let's reboot the Host OS into live mode:
-
+
-
And only now once we are in live mode, we can use veracrypt to create drives. But be aware that everything you write into the system drive will be wiped upon shutting down, if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.
+
And only now once we are in live mode, we can use veracrypt to create hidden encrypted volumes and unlock them. But be aware that everything you write into the system drive will be wiped upon shutting down, if you want to store something persistent accross reboots from live mode, you need to save it in a non-system drive.
So now from there we can create the encrypted volumes (either as files or as entire drives). In this example we'll create an encrypted file:
Here we select that we want a Hidden veracrypt volume as well (which will be able to deny it's existence).
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+ 
+
+ 
-
+
-
-
-
-