Master’s thesis: Plausible deniability analysis of VeraCrypt hidden volumes

[Adam]

Hello,

I would like to share my Master's thesis, focused on the analysis of plausible deniability provided by VeraCrypt hidden volumes from a digital forensic perspective.

The research examines whether the presence of a hidden volume can be inferred through observable and reproducible forensic indicators without breaking VeraCrypt's cryptography.

The main findings show that, in One-Time scenarios, no conclusive indicators were found that reliably distinguish standard volumes from volumes containing a hidden compartment. However, in Multi-Snapshot scenarios, differential analysis of successive container images produced a change-map pattern compatible with hidden-volume activity, providing a significant — although not absolute — indicator for inference.

The research also includes a proof of concept based on controlled false positives intended to reduce the evidential strength of such change maps, although this approach has important limitations for production use.

The thesis has been published in the institutional repository of the Universitat Oberta de Catalunya (UOC):

https://hdl.handle.net/10609/156173

I am sharing it here because VeraCrypt and its hidden-volume mechanism are the main subject of the research.

Thank you for your work on VeraCrypt.

[风之暇想]

Countermeasures should include probabilistically changing the trailer when opening a hidden volume, as well as providing the user with an optional one-click manual trailer change after the hidden volume is opened, in order to resist analysis.