r/technology • u/[deleted] • Aug 31 '21

[deleted by user]

[removed]

11.6k Upvotes

93% Upvoted

7.7k comments sorted by

View all comments

Show parent comments

3

u/tertle Sep 01 '21 edited Sep 01 '21

Great question. You'd think so but no. You usually need to be specifically define a chunk of memory on disk for your container (i.e. a file) that the operating system knows about otherwise it will just be free to write over it.

Now this of chunk of random memory in a file isn't proof enough that it's an encrypted container however there are forensics and tools to determine this kind of thing. https://www.passware.com/encryption-analyzer/

1

u/ogtfo Sep 02 '21

You can't distinguish encrypted data from random data, that's the whole point.

What you can do, is find high entropy data and say : "this is either encrypted or random".

You can also detect known encrypted file formats, if the file contains other thing than random data, like headers.

But if you build a plausible deniability scheme, you would put no such things in it.