| ▲ | Retr0id 3 hours ago | |
It does, but it's extremely unusual for the feature to be in use on modern hardware. I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can just use last n GB as a hidden storage volume. dm-crypt "plain" mode is headerless and can be configured to start from some offset within the underlying block device. The only giveaway here might be forensic examination of the drive's internal wear-leveling data. | ||