I am thinking of using a detached LUKS header for plausible deniability given my threat model doesn’t involve actors who:
- will resort to violence
- snapshot the disk more than once
However, I think this idea would go moot if, somehow, even though the disk is encrypted, they can know the last time I booted the laptop and establish usage patterns.
Thoughts? I am sure there is somewhere else in the laptop beside the encrypted disk that logs this sort of stuff, no?
Thanks