0

I've read veracrypt documentation, but don't understand these 3 points.

• A VeraCrypt volume resides on a device/filesystem that saves data (or on a device/filesystem that is controlled or monitored by a system/device that saves data) (e.g. the value of a timer or counter) that can be used to determine that a block had been written earlier than another block and/or to determine how many times a block has been written/read. Therefore, do not store hidden volumes on such devices/filesystems. To find out whether a device/system saves such data, please refer to documentation supplied with the device/system or contact the vendor/manufacturer.

• A VeraCrypt volume resides on a device that is prone to wear (it is possible to determine that a block has been written/read more times than another block). Therefore, do not store hidden volumes on such devices/filesystems. To find out whether a device is prone to such wear, please refer to documentation supplied with the device or contact the vendor/manufacturer.

What kind of device saves data (point 1) and is prone to wear (point 2)?

• On Windows, make sure you have not deleted any files within a volume within which you intend to create a hidden volume (the cluster bitmap scanner does not detect deleted files).

Don't understand this.

nobody
  • 11,555
  • 2
  • 43
  • 60
  • The points you quoted seem clear enough to me. What parts exactly don't you understand? – Joseph Sible-Reinstate Monica Apr 17 '22 at 20:18
  • @JosephSible-ReinstateMonica Point 1 & 2 ==> What kind of device mentioned in point 1 & 2? HDD? SSD? Point 3 ==> Is that mean we may not delete file at all? –  Apr 17 '22 at 20:32
  • I think the first two are for ciphertext analysis which might weaken the security on deniability of using encrypted volumes, but that would weaken the typical security only marginally for the typical user (and attacker). I guess it's all about "hidden volumes" which is a special case of using. Do not use hidden volumes until you fully understood how they work (I do not!). – U. Windl Jun 30 '23 at 08:27

1 Answers1

1

Wear & Hotspots

dell article

Host write accesses can occur to any location which can cause hot-spots, which causes premature wear in these locations. A technique called wear-leveling is used to prevent the hot-spots.

SSDs and flash memory are prone to wear if the proper hard/firm/software mitigations are not employed due to the way their cells function.

NAND flash wear-out is the breakdown of the oxide layer within the floating gate transistors of NAND flash memory. All of the bits in a NAND flash block must be erased before new data can be written.

Hard drives have no such limitations as flipping of bits magnetically leaves no physical wear or indication of heavy use.

Filesystem & Device Metadata Storage

Filesystem

Various filesystems implement different features. Look through the specs of each respective one to find timestamp/counter data. Also check if you can disable those functions.

  • Ext4 stores inode change time, access time, data modification time, and deletion time.
  • Ext2 stores creation and last modified data
  • FAT32 stores create, modified, and last access timestamps.
  • FAT12/16 have only the last-modified time.
  • Some timestamps can be disabled on FAT systems.

Sources: ext4, ext2 and FAT

Device

Devices such as SSDs may keep times a block has been written to in firmware or in software (ie for aforementioned wear leveling). The presence of such data collection will be in the specs of the drive.

Cluster Bitmap Scanner

Honestly I have no idea what is meant here, it's vague and weirdly worded. I asked a question on SuperUser, maybe they can resolve it.

belkarx
  • 1,326
  • 4
  • 19
  • So we can conclude that point 1 and 2 refer to ssd and other flash storage?
  • How about exFAT timestamps?
  • Thanks for your effort asking about cluster bitmap
    • –  Apr 18 '22 at 10:02
  • @anyanya 1. Yes, that can be assumed, alongside other obscure storage devices that may be impacted (that's quite unlikely but check your individual specs). 2. last access, time zone, create, and modify (source) – belkarx Apr 18 '22 at 15:29
  • Yes, and possibly some other obscure forms of storage that I doubt are applicable (which is why the docs said check your personal specs). Check the ExFAT docs :) – belkarx Apr 18 '22 at 23:05