[jandrese]

Doesn't FAT have the concept of "badblocks" to handle the old days when sectors could randomly fail on drives and they had to work around it? It would only be slightly more suspicious but it would allow the drive to be mounted and used as a regular drive to avoid the even more suspicious unmounted volume issue. The data in the sectors would obviously be encrypted so it looks like random noise if someone does start poking around looking at it.

[Retr0id]

It does, but it's extremely unusual for the feature to be in use on modern hardware.

I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can just use last n GB as a hidden storage volume. dm-crypt "plain" mode is headerless and can be configured to start from some offset within the underlying block device.

The only giveaway here might be forensic examination of the drive's internal wear-leveling data.

[marysol5]

>It does, but it's extremely unusual for the feature to be in use on modern hardware.

FAT is a filesystem, it isn't hardware. They're talking about the table storing numbers of bad sectors/blocks.

The system you just described is exactly what TrueCrypt did, where if you overwrote the capacity and into the "hidden" data, you'd end up killing the hidden partition.

[Retr0id]

Modern hardware tries not expose bad sectors to the filesystem layer at all, they are managed by the drive firmware (transparently remapped, until the drive runs out of spare sectors). Thus, you will ~never see bad sectors marked in the FAT on modern hardware.