Examining VeraCrypt Security: Finding Hidden Volumes Using Reverser Engineering Techniques
TL;DR
The research paper comes to the final conclusion that it is still difficult for forensic investigators to detect the concealed volume system only from an investigation of the hard disc of the suspect machine.
Abstract
Data software that encrypts information is being used by more and more people to protect data secrecy. The freely downloadable and open-source programme known as VeraCrypt is one tool that supports data encryption. It can be difficult for a digital forensic investigator to even find encrypted data. The paper explores the worst-case situation when a memory seizure or access to the data in a decrypted state is not conceivable and the forensic detective only has access to the suspicious computer's hard disc after the device has been off for a significant amount of time. It starts by assessing the effectiveness of current statistical tests in distinguishing between encrypted VeraCrypt data and other non-encrypted data. By analysing the raw byte data content of the suspicious hard disc, a forensic investigator could utilise a specific process model to locate the encrypted data. The secret operating system and volume, however, continue to be invisible. The research paper comes to the final conclusion that it is still difficult for forensic investigators to detect the concealed volume system only from an investigation of the hard disc of the suspect machine.