Hacker News Reader

Which would you rather go down for: destruction of evidence, or what's in your hard drive? I'm asking a technical question, not a legal one. There are many instances where this would be preferable than giving up the data.

View on HN

If someone released such a tool, the feds would make sure to clone your hard drive before supplying the password to it, or write a patched version of the tool that reads it to remove the disk wiping call.

And then you'd be in really hot water.

An interesting talk on disk antiforensics: https://www.youtube.com/watch?v=qZtkANvDxZA

Of course, having watched this, the feds might look for such tricks...

I expect cloning to already be standard forensic procedure, but perhaps I'm wrong. If not, it should be.

yep. Work on the copy, or the copy of the copy in my case. It's digital with a hash, not a vhs tape

Ah cloning, very good point. So that raises a new question: Is there any way to prevent decryption of a drive, when the password is forcibly obtained?

Reply on news.ycombinator.com