Tails automatically detects my VeraCrypt USB drive — can this be prevented?
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
I use a VeraCrypt-encrypted external USB drive. When I connect it to a Windows computer, Windows does not recognize the filesystem and simply asks whether I want to format the drive. Nothing indicates that it is a VeraCrypt volume.
However, when I connect the same drive to Tails 7.10.1, a VeraCrypt authentication dialog immediately appears, asking for the password. The dialog even displays options such as Hidden Volume, Windows System Volume, Uses Keyfiles and PIM Number.
This means that someone looking at the screen could reasonably infer that the USB drive is a VeraCrypt volume, which is undesirable from an OPSEC / plausible-deniability perspective.
My understanding is that VeraCrypt volumes do not contain an identifiable signature that reveals them as VeraCrypt volumes. So I am wondering:
How does Tails/Linux detect that the drive may be a VeraCrypt volume?
Is it actively testing the volume header, or is there some other mechanism involved?
And more importantly, is there a way to prevent this automatic detection/prompt while still being able to mount the volume manually through VeraCrypt?
Ideally, I would like the USB drive to appear simply as an unknown/unformatted drive, as it does under Windows, and then manually open it with VeraCrypt when I choose to do so.
Any information about how VeraCrypt volumes are detected by Linux/Tails, and whether this behavior can be disabled, would be greatly appreciated.
There was a discussion of this very topic back in 2020, showing that both Elcomsoft tools and Tails "identify" a VeraCrypt volume by finding apparently random data where VeraCrypt might have placed it. Sometimes it is a false positive, as Keyszer Soze demonstrates in the last post of that thread. Read it here in case you need to mount a defense denying the charges when you are being beaten with a rubber hose to reveal the VeraCrypt password. If you test it yourself with different results, be sure to share them here.