Can you save files in unallocated space on a harddrive?

I read about a swedish pedofile who didn´t get punished for having severe childporn on his computer. Here in sweden it is a crime to posess childporn in any form (well maybe text, im not sure) The court argues that the prosecutor couldnt prove that the pedofile knowingly had them on his hard drive since it was found in "unallocated space" of the hard drive.

Maybe I am wrong but isnt that what Truecrypt (maybe other) does? Hide the container in "unallocated" space? The article did not say if and how the police broke the encryption or if there were any. Is it btw possible to store pictures and movies in unallocated space without having it encrypted?

 

Unallocated space, is space that does not appear in the File Allocation Table. It is "ready to be written to" as far as Windows is concerned, but still may contain data from what was previously there (unless measures were taken to securely delete the file). A quick format of the partition can also leave data on the disk, that was previously there.

TC does not use unallocated space. With Hidden containers/partitions, the entire space is filled with random data. TC then just offsets the hidden volume, and knows how to find it. But the whole, say, 4.6 Gig ".vob" file that is the container, is allocated in Windows.

If you save "badpicture.jpg" and then remove that information from the File Allocation Table (or delete it through Explorer), you have just stored data in unallocated space. You can get it back by running various 'undelete' software. How you keep Windows from overwriting it, I don't know. This is how I understand it on a user level.

I don't know the details of your Swedish case...maybe he just happened to buy a drive from Ebay before the bust, and did a quick format? "Hey, I just got this, here is the receipt. I just Installed Windows, I don't know what was on there before"...who knows.

PD

 

Thanks for the explanation!