Different actions on different passwords?

[Robert P. J. Day]

On Thu, 2 Jan 2014, Joe Zeff wrote:

> On 01/02/2014 08:32 AM, Steve Searle wrote:
> > You would be better off using disc encryption, and claiming that you
> > used a long pass phrase which you had written down rather than
> > remembered, and that you had destroyed the paper it was written on.
>
> Just to toss an idea out here.  Imagine an accountant who has all of
> his work data on a big partition mounted at (let's say) /data.  If
> he wanted to hide a "second set of books," he could close his
> accounting program, unmount the partition and restart the program,
> so that /data now pointed to someplace on his main partition.  When
> he's done, he exits and remounts the partition.  The data's there,
> you can get to it if you know what to do, but I can't help but
> wonder how likely anybody, such as a forensic accountant, that was
> examining your system would even think of such a thing.  Any
> thoughts?

  1) friend of mine many years ago used to do that -- while working
     full-time for a company, he created a separate filesystem on the
     company server for his own stuff that he would mount manually.

  2) any forensic analyst that would be fooled by something like that
     would be a total incompetent.

rday

-- 

========================================================================
Robert P. J. Day                                 Ottawa, Ontario, CANADA
                        http://crashcourse.ca

Twitter:                                       http://twitter.com/rpjday
LinkedIn:                               http://ca.linkedin.com/in/rpjday
========================================================================