Why doesn't TrueCrypt Container Update?

I created a TC travelers mode container on the 31/7/08

I use it every day and save new data to it all the time.

But when I look at the 4GB TC data file, the time stamp still says, 31/7/08

Does anyone know why it doesn't update the timestamp?

The Configuration.xml file which is in the same folder, that time and date updates each day, so why not the 4GB TV data container?

 

Because you have TC configured to preserve the timestamps.

 

Ahhh ok.

I looked at the options and found "preserve timestamps of file containers", and when I tried to disable it, it said: "Warning, if timestamps are not preserved, plausible deniability may be adversely affected!"

Could you please explain that to me in basic layman terms?

What exactly does "plausible deniability may be adversely affected!" mean?

And why is it such a bad thing for it to give a WARNING!

Thanks

 

If you preserve the timestamps the timestamp is made when the file container is made not last accessed. The containter could have been accessed 3 years ago when you made this like you said, even though you really access it yesterday thats what they call plausible deniability.

 

So why the WARNING message if I disable it? Why does it matter if the timestamp gets updated to whenever I access it and write to it?

Is the reason in case someone stole my laptop and because the timestamp is old, that they won't think it contains any valuable current data? Is it to fool them?

 

No it is more like say your employer catches you looking at some encrypted folder on your laptop, you can tell him/her you last accessed the file 3 years ago (and old files or whatever) and getting your laptop stolen with sensitive files on it is a good reason to have a container anyway.

 

Yeah, I love my TC container. I run everything in it. And in it I run portableapps, so there is no personal data on my windows.

So I can disable the timestamp and it won't corrupt or harm my container?

 

I found this section of TC's site quite interesting (please excuse the length, it all feeds in):

I'm not sure about disabling the timestamp not harming your container, but if it can be inadvertently modified by other means as suggested, it doesn't sound like it could harm it to me.

My guess re: the importance of preserving the original timestamp, is so that an adversary pays little or no attention to the container file, as the timestamp would suggest to them that you haven't accessed that ~.dat (assuming you changed the container's extension to ~.dat) file recently/for a great period of time, so it can't be of particular importance to you (or pertinent to their digging). Adversary xyz then potentially ignores the file.

I can only assume it would be compared with all other discoverable data...scattered word docs, images, folders & so on that were most recently accessed... So I suppose the more 'decoys'/suspicious/interesting looking files that then exist, the better the chances of your container file's non-discovery.

 

I removed the time stamp and it running the same without any problem.

 

Anyone familiar with TrueCrypt's capabilities will not be fooled by this type of grade-school subterfuge. Most encrypted data stands out like a sore thumb when you actually look for it. Any large, unrecognizable file containing extremely high-quality random data is very likely to be an encrypted file, no matter what filename, extension or timestamp is attached. The best you can do is try to hide it within wiped data, but even that technique is full of pitfalls and is difficult to do properly.

 

There's alot different types of encription software outthere, Keepass password safe encrypts its database with twofish or AES (128 bits/256 bits). You could hide several documents in Keepass's database. Keywallet also encrypts it's datrabase...with BlowFish, I never tryed it though, not everybody is familiar with truecrypt. I mean non-Computer Forensics people or your average computer user.

 

Hi Dantz,

I think you might be missing the point. The key word is "plausible." It's not that others don't know of the capability or understand what all you can or cannot do with Truecrypt. However, it gives you plausible deniability - meaning they cannot prove that the containers were used yesterday. While I agree that on the surface it looks "grade-school" it's all about not the actual features, and whether anybody knows of these things, it's that it offers the plausible deniability that cannot be proved. Just because you "can" do something doesn't neccesasrily mean you "have" done something. That's the thinking - it's more for legal purposes than anything else.

 

I'm all for people using encryption, as it's an extremely effective way to protect your data. However, when users try to take things a step farther by attempting to hide the fact that they are using encryption they are generally wading into waters that are far deeper than they have imagined. Thanks to programs like TrueCrypt, using strong and effective encryption is extremely easy to do. However, hiding the fact that you are using encryption is practically impossible, and most of the schemes that I have seen to date are not at all plausible to a knowledgeable person with a healthy degree of skepticism.

I also feel that the term "plausible deniability" is widely misused and misunderstood. In most cases it should be replaced with something along the lines of "appears to be highly suspicious but would probably be impossible to prove in a court of law". Is this what most people are trying to achieve when they attempt to hide their use of encryption? I don't think so, as they obviously don't want to attract attention or suspicion of any sort. In my experience, most users are truly attempting to hide their use of encryption from all comers, and are not merely attempting to protect themselves from future legal proceedings. What they don't realize is how difficult that task can be and how many pitfalls exist.

Without going into great and interminable detail about all of the various ways to hide or disguise data and all of the various techniques for discovering hidden or disguised data, my advice for most users would be to either use encryption openly, or not at all.