We need plausible deniability and a way to hide that these tools are even being used.
We need plausible deniability and a way to hide that these tools are even being used.
There are quite a few people in the whole process from surveillance to arresting and detaining them, that should have noticed, that they did nothing illegal (or atleast are employed there to be the ones who should be noticing stuff like this).
Engineer builds a house, uses way less material then needed to be safe, because it saves money,... then house collapses, engineer knew (or should have known) how much concrete/rebar is needed, still approved it, criminal negligence, jail. Why not the same for police, prosecutors, judges, etc.?
If you are doing something smaller personal means that just happens to be against the law, if you have to resort to plausible deniability, you already fucked up in a lot of ways. The sad truth is that many of the "hackers" are like a few steps away from being script kiddies, without basic understanding of opsec. The actual good people all realized that its much easier to go white hat and get paid reliable salary and live a comfortable life rather than fight an ideological war that doesn't matter in the end.
Normal everyday OS in Main encrypted volume, then your secret hidden OS in the hidden volume.
Should someone make you divulge your password, you give them the one to get access to the normal boring mundane volume, and they have no proof that the other volume exists.
There should be a way to make the Tails OS in such a way that each time the USB is plugged in, the contents of the flash drive are moved to your computer RAM, so that if you plug it off without running `shutdown` explicitly, not only you'll shut the computer down in 2 seconds, but your USB is also clean. The `shutdown` command being run with the USB still plugged in then copies the image from RAM back to your thumb drive. Your non-destructive shutdown routine will obviously take a lot longer though.
(nsfw... if you can't open it, the url explains it all)
The fact that you've got valuable data on the "boring" volume is enough to explain why it is encrypted.
If you use an amnesic OS that does not right to the USB and is read only on the hidden volume, you won't be racking up the SMART data clocks on write cycles when within the "interesting" volume, making it look completely like a passive USB, sat there looking pretty and gathering dust just holding your wallets.
But even then, you could explain any high usage in the SMART data as it being a random USB you had lying around that you used to use daily, that you decided to throw your wallets on. The SMART data is not timestamped, it's just a total cumulative counter that goes up over the entire life of the device.