[gruez]

>VeraCrypt has a cool function which is a reserved space for a decoy OS.[1] Everything else registers as free space while decrypting to dummy volume. You make the dummy volume look lived in, and forget. provide dummy password, volume decrypts such that only dummy is accessible/readable. give proper password, real OS and FS decrypt and load.

See: https://news.ycombinator.com/item?id=49057812

Implementing it in a convincing way is harder than you think. Moreover if you're under the type of regime that will throw you in jail for not giving up a password, they're probably not going to let you off the hook because they can't definitively prove you have a hidden volume.

[Grimblewald]

I could be wrong, but my understanding is that the dummy OS views the remaining space as legitimate and accessible free space. Using dummy directly is of course dangerous, as you might overwrite sectors with legitimate data, but also, you can access dummy os from secret. so you'd drive dummy from secret to prevent that but can load dummy as main if under duress and it looks fine. Browser, logged into various inconsequential things, random files for inoffensive memes and other human stuff in downloads folder etc. maybe an email account you've signed up to a few newsletters and e-stores that send spam logging in via an email client that auto-launches etc.

Done well, I see no reason it should raise redflags in routine stops, so unless you're being targeted (at which point you've got way bigger problems) it should just seem like you're a run of the mill person who does not use their device to its full capacity, which is the majority of users.

at some point, having any mitigations even present is a problem. At some point being met with a boot password at all is a problem that puts you on a list. I have no solution there other than to not go to those countries or keep dummy hot.

[gruez]

If you read the linked thread, you'd see the reasons are:

1. SSDs (including phones) have TRIM/discard, so you need to disable it, otherwise the hidden volume would get wiped. You going out of your way to disable it is going to be suspicious.

2. Even if the above wasn't an issue, you can't really use the outer os to any meaningful extent, because you run the risk of overwriting the inner volume. That makes your decoy os suspicious. It's not definitive proof you have a hidden volume, but I doubt the authorities would care too much about that.

[CGamesPlay]

I last used this feature probably more than a decade ago, but: you provide 2 passwords when decrypting. If the first password is the main volume, the second is attempted as a hidden volume. If both match, the main volume registers the hidden volume as free space but prevents writing to it. If the hidden volume doesn't match, the main volume will clobber the hidden volume.

So the main/hidden volumes really works like a duress: you might destroy your hidden volume while using the main one under duress, but that does not apply when using the main volume while able to additionally unlock the hidden volume.

If you are in a situation to need to worry about any of this, you're probably going to jail for one reason or another, anyways.

[gruez]

>So the main/hidden volumes really works like a duress: you might destroy your hidden volume while using the main one under duress, but that does not apply when using the main volume while able to additionally unlock the hidden volume.

The problem is that if the main volume doesn't have any signs of activity, then that's highly suspicious. Why are you carrying around a laptop that's mostly empty and hasn't been used in months? Why is it that despite seemingly not being used in months, there's physical signs of wear, like scratches or dust accumulation? If you do try to make the main volume seem "used", you run the risk of accidentally overwriting your hidden volume.

[CGamesPlay]

> If you do try to make the main volume seem "used", you run the risk of accidentally overwriting your hidden volume.

No, because during the normal use of the main volume, you provided the hidden volume password, so this was never a risk. So the the obvious answer to your question is therefore: use your main volume most of the time. Only switch to the hidden volume when you're doing your hidden activity.

FWIW, I also think that the whole scheme is better applied to external storage volumes rather than bootable OS volumes: a flash card with a main volume containing things a reasonable person would want to keep from accidentally being lost (tax documents, bank statements, and so on).

[inigyou]

By using Veracrypt you're already proving there could be a hidden volume - and it won't TRIM anything, for that reason.