I save KeePassXC's database each time I add a new entry. Been doing that for years. Databases get corrupted. If anything, it is good OpSec because you are safeguarding your most valuable assets.
But as far as "plausible deniability" I paste what I wrote before:
There deep complexities here that you will have to research.
The deepest aspect is that "as of October 2024, there are no known ways to accomplish FDE with plausible deniability on any Linux distribution."
The fundamental problem here is that once you're suspected it's impossible to prove your innocence. Any attempt can be seen as hiding your guilt. Even the existence of a perfectly clean file system with no suspicious random patches could be considered suspicious.
This is a delicate subject and must be dealt with precision on a legal level first and then a technical level.
"Plausible deniability" is indeed more of a legal problem, than a technical one; please read sections 2.4 and 5.2 of the cryptsetup FAQ.
https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions
On the technical aspect:
The disk encryption feature of Whonix can protect the content of the disks configured for a VM only, and, worst, there may be complications in having different encryptions.
But more importantly, Whonix would advise against "USB Passthrough" to minimize the surface provided to a potential attacker. Because by opening the ports you have allowed write access.
¬ "outside of Whonix this is a good option because the hidden volume will always remain hidden."
-- Unfortunately, that is not quite how a hidden volume works.
¬ ¬ ¬ ON THE LEGAL ASPECTS:
"Shatter Secrets: Using Secret Sharing to Cross Borders with Encrypted Device"
https://www.cypherpunks.ca/~iang/pubs/shattersecrets-spw18.pdf
But as far as "plausible deniability" I paste what I wrote before:
/post/04f515fe5ac669cb29ab/#c-1c47d3b93d789a7214
There deep complexities here that you will have to research.
The deepest aspect is that "as of October 2024, there are no known ways to accomplish FDE with plausible deniability on any Linux distribution."
The fundamental problem here is that once you're suspected it's impossible to prove your innocence. Any attempt can be seen as hiding your guilt. Even the existence of a perfectly clean file system with no suspicious random patches could be considered suspicious.
This is a delicate subject and must be dealt with precision on a legal level first and then a technical level.
"Plausible deniability" is indeed more of a legal problem, than a technical one; please read sections 2.4 and 5.2 of the cryptsetup FAQ.
https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions
On the technical aspect:
The disk encryption feature of Whonix can protect the content of the disks configured for a VM only, and, worst, there may be complications in having different encryptions.
But more importantly, Whonix would advise against "USB Passthrough" to minimize the surface provided to a potential attacker. Because by opening the ports you have allowed write access.
¬ "outside of Whonix this is a good option because the hidden volume will always remain hidden."
-- Unfortunately, that is not quite how a hidden volume works.
¬ ¬ ¬ ON THE LEGAL ASPECTS:
"Shatter Secrets: Using Secret Sharing to Cross Borders with Encrypted Device"
https://www.cypherpunks.ca/~iang/pubs/shattersecrets-spw18.pdf
________________________________________________________________________________
https://shufflecake.net
"Shufflecake: Plausible Deniability for Multiple Hidden Filesystems on Linux"
https://eprint.iacr.org/2023/1529.pdf
________________________________________________________________________________
"StegFS: A Steganographic File System for Linux"
https://www.cl.cam.ac.uk/~mgk25/ih99-stegfs.pdf
________________________________________________________________________________
"Steg: a deniably-encrypted block device"
https://dmsteg.sourceforge.net/Steg.pdf
________________________________________________________________________________
"Plausible Deniability Setup Guide"
https://docs.onlykey.io/pdguide.html
________________________________________________________________________________