You can even take it a step further: full disk encryption, one key will give an innocent Windows install, and another key will give the diabolical plans.
However, information is only compressible to the extent of redundancy involved, so this can be spotted: compare the amount of encrypted data with the size of the innocent data.
There's an even bigger weakness: timestamps in files and the Windows event log. These will show if your "innocent" OS hasn't been booted for $long_time...
Just reset the hardware clock back whenever you power off. The pretend your clock is three years out of whack, and that you don't care. Hey presto - your ancient windows install looks "fresh".
Comments
Of course this is possible.
You can even take it a step further: full disk encryption, one key will give an innocent Windows install, and another key will give the diabolical plans.
However, information is only compressible to the extent of redundancy involved, so this can be spotted: compare the amount of encrypted data with the size of the innocent data.
Make sure to add some shameful evidences on the innocent Windows install to make it more convincing. "Sh.. you found my porn folder! Well done guys".
There's an even bigger weakness: timestamps in files and the Windows event log. These will show if your "innocent" OS hasn't been booted for $long_time...
Just reset the hardware clock back whenever you power off. The pretend your clock is three years out of whack, and that you don't care. Hey presto - your ancient windows install looks "fresh".