Hi
Let's assume you absolutely need to used windows.
You do not store anything incriminating on your Hdd, BUT due to daily usage artifacts will remain.
What would be the best way to protect yourself against HDD forensics if the computer is seized?
After computer seizure there are 2 scenarios:
1. offline hdd forensics.
2. you are forced to reveal password and decrypt hdd so that forensics tools can collect data.
May the Force be with you!
Luks partition
or virtual machine with encrypted lvm volume pre zeroed with a passphrase long and in your mind.
if something happen one script destroy everything in one click in a second, if you dont get the chance of running the script, lvm crypto on vm file, good lucky to this forensic team.
you also can gpt your windows partition with simple bitlocker to transform their lives into more deep nightmare.
an also encrypt files more sensitive
just imagine:
- bitlocker user know only passcode on partition of the system and files
- vm with lvm volume with passphares and luks crypto partitions
- lvm file wiped out
- encrypted files
forensic team:
- dont have your windows pass
- dont have your gpt bitlocker pass
- dont know the name of vm file
- dont have anymore the vm file
- had to recover mount lvm
- now they dont have luks volume key
- after luks volume key they got encrypted files xD
easy to setup hard to decrypt
just get yourself used with good long pass that you can remember, dont repeat them.
good lucky
or virtual machine with encrypted lvm volume pre zeroed with a passphrase long and in your mind.
if something happen one script destroy everything in one click in a second, if you dont get the chance of running the script, lvm crypto on vm file, good lucky to this forensic team.
you also can gpt your windows partition with simple bitlocker to transform their lives into more deep nightmare.
an also encrypt files more sensitive
just imagine:
- bitlocker user know only passcode on partition of the system and files
- vm with lvm volume with passphares and luks crypto partitions
- lvm file wiped out
- encrypted files
forensic team:
- dont have your windows pass
- dont have your gpt bitlocker pass
- dont know the name of vm file
- dont have anymore the vm file
- had to recover mount lvm
- now they dont have luks volume key
- after luks volume key they got encrypted files xD
easy to setup hard to decrypt
just get yourself used with good long pass that you can remember, dont repeat them.
good lucky
sorry forgot somethings, in any case, destroy your rams chips, and disable windows pagination files, just in case of "live capture data on ram"