VeraCrypt Hidden Volume
Definition
A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes; without the second password the existence of the hidden volume is statistically indistinguishable from free space. The deniability is the point.
- Access method
- Two different passwords unlock two different volumes
- Storage location
- Nested inside the free space of an outer VeraCrypt volume
- Detection method
- Statistical entropy and free-space pattern analysis
Common questions
What is a VeraCrypt hidden volume?+
A hidden volume is a second encrypted container nested inside the free space of a primary VeraCrypt volume. It can be unlocked with a separate password, allowing someone to access different data depending on which password they use.
How does the deniability work?+
Without knowing the second password, the hidden volume appears statistically indistinguishable from ordinary free space. An examiner cannot prove the hidden volume exists based on the encrypted data alone, giving the user plausible deniability about what the drive contains.
How do forensic examiners detect hidden volumes?+
Examiners look for anomalies in entropy patterns and free-space structure. If the free space shows high entropy consistent with encrypted data rather than the low-entropy signature of genuinely empty space, it can indicate a hidden volume is present.
Related terms
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Deletion vs Erasure
- Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The...
- File Carving
- Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
Explained in these topics
- Anti-Forensic Techniques and Investigator Counter-MethodsA second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes; without the second passw...
- Data Recovery and File Carving: Deleted, Hidden, EncryptedA second encrypted volume nested inside the free space of an outer VeraCrypt volume, accessed with a different password. Designed for plausible deniability; st...