Two words: “J’ai oublié”
If the judge does not believe you: "That's contempt. You can sit in jail until you decide to remember."
A better two words would be "hidden volume".
https://www.truecrypt71a.com/documentation/plausible-deniabi...
In the US, a defendant was held in contempt of court. Eventually the courts decided that 18 months is the maximum incarceration period to try and force someone to give up a password [1]. Which still does seem pretty chilling: forgetting your password can land you a year and a half in prison.
1. https://arstechnica.com/tech-policy/2020/02/man-who-refused-...
Nobody is going to believe that you “forgot” the password to your phone that you use multiple times a day or at least a week. Your lawyer is not even going to mention that as an argument and he’s going to strongly advise you don’t because it sounds prima facie absurd.
Now, if the case was about an encrypted hard drive you kept in your bank’s safety deposit box that you put there two years ago, it might work, because that sounds much more reasonable.
Ed: and apply this to the very case you linked: the guy was held for the maximum contempt length possible because the evidence was so strong; they got his laptop, which indicated he downloaded illegal files to the external drives; they got his phone, which had illegal material; they have witnesses testifying that he showed them illegal material. If the encrypted drives had been their ONLY evidence, he almost certainly wouldn’t have been in jail for contempt.
He was held for nearly 3 times the maximum contempt length because prosecutors argued he was not a witness even when they were holding in contempt for his refusal to give testimony. It's also in contradiction of existing precedence [1]. If you have a safe locked with a key, the government can demand you give them the key if it's in your possession. A safe locked with a combination, the government cannot ask you to produce the code.
And to be clear, there's probably enough evidence to convict even without the contents of the encrypted drives. But that makes the imprisonment on contempt even more dubious: they don't need these contents and the defendant attempted to decrypt the drives and failed (intentionally or not, we can't know without a mind-reading device).
1. https://crsreports.congress.gov/product/pdf/LSB/LSB10416#:~:....
In all fairness, there is a lot of documentation in veracrypt's manual about how to properly hide a hidden partition, and how it's circumvented.
Most of them rely on knowledge of the encrypted container over time. A single point in time is unlikely to reveal a hidden partition, but if you are being monitored that is possible.
Please note that backups or wear leveling on an SSD, or just the TRIM command not deleting stored data can provide those points in time. Hidden partitions work best on magnetic drives.
Read them here: https://veracrypt.eu/en/Security%20Requirements%20for%20Hidd...
It's possible to move the encrypted volume 50GB from the header and fill the disk with random bytes, but it's not doable through the standard GUI.
In an encrypted state, it's impossible to tell the difference between the hidden volume and random data. When you use your real passphrase, the primary header is decrypted and the hidden volume may just be random-data empty space. If the key you entered decrypts the random bytes between the first Truecrypt header and the first partition, it's clear that the key belongs to the secret header and not the normal partition.
You can try to cover your tracks; you can use your hidden volume as the main volume and enter the main volume key when forced to come up with a password.
However, you'll have to make sure the activity logs on the PC line up with the other logs available (i.e. increments in power on hours, external drive logs and timestamps, external access logs, etc.) that can prove that the partition you've unlocked doesn't contain the OS that caused all kinds of side effects. Hell, you can probably find something related to relocated sectors/wear levelling statistics to find the clusters that are in use.
When the passphrase for the hidden volume has been entered, you can find the physical offsets of the encrypted data and find out that the first half the drive (or less, or more, depending on your setup) isn't mapped to your booted partition.
A completely read-only OS with no logging outside RAM or connections to the outside might be used securely if you use the hidden volume as your main OS, but such a system would be too difficult to use properly.
As always, opsec is crucial for security even if your software algorithms are absolutely perfect. If you follow the guidelines set forth by Veracrypt, it should be very difficult to prove the presence of a hidden partition. That does mean you should be using your secondary OS as often as your hidden OS and analysis from external devices (such as network traffic) should not be able to tell the difference between the two.
Sounds like it is an OpSec risk to do the "resecuring of 50G re-displacement upon orderly shutdown" for "safest" traveling mode. One could forget or didn't have time to do that proper shutdown sequence.
With Tails it'd be feasible. You'd have your user data on a hidden volume.
I know it works like that in the states, but does it also work like that in France?
In most places contempt is limited in time.
We don't really have contempt of court, mainly because we have a civil law system not a common law one.
https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI0000...
Contempt of court exists in civil law as well.
Countries with civil law systems tend not to have contempt of court (or very limited versions). Of course, that's variable from country to country, civil and common law being more akin to trend than hard categories.
Doesn't always pay to have longer password unless a corresponding threat exists to mandate such... a longer password.