Re:Judge: Americans can be forced to decrypt their laptops
by corin_ on Monday January 23, 2012 @08:23PM
(#3503015)
How do you prove in a court of law that a.) those timestamps are correct and b.) I have definitely used it since July 2011?
Re:Judge: Americans can be forced to decrypt their laptops
by burgerbrain on Monday January 23, 2012 @08:18PM
(#3502998)
Standard practice is to use the one you don't care about for things you don't care about (which for most people, will be most things. Web browsing, gaming, emailing the aunt, whatever).
Timestamps are going to be at the FS layer or higher, not much Truecrypt can realistically do about that..
Re:Judge: Americans can be forced to decrypt their laptops
by CGamesPlay on Monday January 23, 2012 @08:59PM
(#3503124)
Truecrypt does have an option to disable file time updates on file volumes. Also for ext at least, you can mount with nomtime, noatime, noctime and completely disable file times.
Re:Judge: Americans can be forced to decrypt their laptops
by pyre on Tuesday January 24, 2012 @04:01AM
(#3504025)
How does preventing the filesystem from writing timestamps solve anything? We're talking about the 'boring partition' having timestamps that suggest that you haven't used it in months (i.e. really old timestamps), when there is probably evidence elsewhere that you have used it (e.g. emails that you've sent since those timestamps).
Re:Judge: Americans can be forced to decrypt their laptops
by jiggy2011 on Tuesday January 24, 2012 @05:16AM
(#3504161)
just write false timestamps to the FS saying it was used more recently?
Re:Judge: Americans can be forced to decrypt their laptops
by Karunamon on Tuesday January 24, 2012 @10:52AM
(#3505251)
Or scramble them altogether. Every write to the filesystem through Truecrypt's driver results in a completely random (but still valid) ctime/atime for that file.
I can't readily think of any Windows processes this would break.
It's Jan 2012. What do you think is going to happen when they see that the one you gave up the code to hasn't been touched since July 2011?
Does Truecrypt have an option to not record date/time stamps on volumes, or better yet, scramble them?