On 07/14/2011 06:39 PM, Philipp Wendler wrote: > I always thought that using trim would essentially be the same as not > writing random data to your disk before encrypting it, and this behavior > is actually the default. mkfs will TRIM the whole device, so only data written after are there. (You can do this later using fstrim command - all fs unused space is discarded.) So in your case (like device wiped by zeros initially), yes, it is the same, you can easily distinguish zeroes from random noise. But if you fill disk by random and someone later run fstrim while device was mounted, it will uncover various patterns there. This is new problem. I am almost sure that filesystem type could be detected from ciphertext device by using non-discarded block pattern analysis. What else depends on situation. If you have some analysis what is possible to recover, please post it to the list, it could be very interesting. Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
