Hiding files into empty space in a FDE system.

[Mirtk-Srdja-Plandr]

Let's take the following situation : I am using a Linux system encrypted with LUKS. As LUKS (correct me if I am wrong) fill all the empty space with random data, I could embed easily a file into this empty space in a truly undetectable way. The question is : where to embed the file if I want to ensure filesystem integrity? Also, is it bad to embed file into empty space from a ext4 filesystem, like a LUKS encrypted Linux system?

[hakavlad]

The same: use FAT32 or exFAT and embed with a sufficient offset.

ext4 is probably bad for this because it does not write data sequentially.

1. Format: LUKS + FAT + RANDOM. The LUKS + FAT header will be at the start of the partition.
2. Add decoy files at the beginning.
3. Embed the real payload with an offset.

[hakavlad]

As LUKS (correct me if I am wrong) fill all the empty space with random data

Not by default. It depends.

[hakavlad]

I am using a Linux system encrypted with LUKS. As LUKS (correct me if I am wrong) fill all the empty space with random data, I could embed easily a file into this empty space

Embed it in a separate partition, not in the system partition.

[hakavlad]

LUKS (correct me if I am wrong) fill all the empty space with random data

Gnome Disks uses checkbox for this.

Test entropy with binwalk:

$ binwalk --entropy --fast /dev/sdX

[hakavlad]

Best practices have not yet been established. Further research is needed.