This project has moved and is read-only. For the latest updates, please go here.

Timestamp on Container File

Topics: Users Discussion
Nov 15, 2015 at 6:00 PM
I have been using a Truecrypt container file to hold credit card information, banking information, etc. since November 2008. The timestamp on that file has not changed in all the times the information on the hidden volume has been updated. I consider this to be a good feature for security. While browsing the Veracrypt user manual I noted that under some circumstances the timestamp on a Veracrypt container file may change. Is that correct, and if so, is it possible to use a Veracrypt container file in such a way that the timestamp will not change? Thanks in advance for any answer.
Nov 15, 2015 at 6:03 PM
Edited Nov 15, 2015 at 6:03 PM
Can you provide the link to the circumstances the timestamp will change in VeraCrypt?

It should be the same circumstances as TrueCrypt since VeraCrypt is a code fork from the TrueCrypt code.
Nov 15, 2015 at 6:48 PM
On page, in the 15th paragraph (marked by >>) that starts with "Preserving of any timestamp ..." the second sentence states: "Note: When you write to a file-hosted hidden volume, the timestamp of the container may change."

In my particular Truecrypt instance, while the timestamps for the creation and access may change (e.g., due to copying to/from a backup disk or opening with some application like a hex viewer), the modification date and time have never changed from November 2008 which gives me some plausible deniability that I don't know what the file contains. I am getting ready to change to Verycrypt and wanted to know if the same behavior would be there. I think you have already answered my question when you state that "It should be the same circumstances as TrueCrypt since VeraCrypt is a code fork from the TrueCrypt code." Thank you for your reply.
Nov 15, 2015 at 8:12 PM
FYI: This is the same wording in the TrueCrypt version 7.1a documentation.
Apr 23, 2016 at 9:59 PM
I know this an old thread, but still, these things become a sort of de facto wiki, so:

2 ways to address this, I think should work, but I haven't tested:
  1. Keep the container file in a directory set read only. Assuming that works,
    I think it would be the best approach.
  2. Alternately, use a command like "touch" (that works in bash, I'm not sure
    what the equivalent is in other interpreters like the Win comman line,
    for example, but I'm sure there is one) to reset the time stamps to the
    same specific date every time you dismount it.