You cannot differentiate between random data or encrypted data, when it is done right. That is one of the reasons why you should initialize an encrypted drive with random data beforehand
That scanner is simply looking for high entropy data, and then report to its operator. It wouldn’t care if it is a drive or a volume or a file. If the entropy is high, flag it.
All random data have high entropy, same for encrypted data. The officer can see you have high entropy data then start throwing questions at you.
This community need better understanding of cryptography and how it translates to real world. Deniable encryption exists and does work on paper, but only on paper.
The most relevant part is 5.18 and it only talks about partitions not files. A file can be way more easily hidden in a partition then a partition.
It is simply no hope aginst an automated scanner. No one search for files manually today.
You cannot differentiate between random data or encrypted data, when it is done right. That is one of the reasons why you should initialize an encrypted drive with random data beforehand
That scanner is simply looking for high entropy data, and then report to its operator. It wouldn’t care if it is a drive or a volume or a file. If the entropy is high, flag it.
All random data have high entropy, same for encrypted data. The officer can see you have high entropy data then start throwing questions at you.
This community need better understanding of cryptography and how it translates to real world. Deniable encryption exists and does work on paper, but only on paper.
That is exactly what i said.
If random or deleted or fragmented or corrupted files will lead to me being questioned, then every data carrier will lead to a lotof questions.
Sorry. Data structures exists and uniformly random data is rare. Patterns still exists.
And deleted is a bad counter as deleted files won’t have a record in the file system.