Backup Procedure
First we open the hidden volume:
Backup all of your critical data (ssh config, ssh keys, pgp keys, keepass .kdbx files, etc.) (max size= 10Mb)
Then close the hidden volume:
Open the decoy volume of the veracrypt volume diary.vc
write something in there such as your week in a small text file, name it with today's date. (don't reveal the presence of a hidden file in the text content). This is just an example as to what content you could put there. Goal is that the content must make sense in case if you're forced to type in your password there. Second goal is that for each veracrypt hidden volume changes that occur, the content of the decoy partition must also change because otherwise it will reveal the existance of the hidden volume if the remote server keeps the previous versions of each file.
Once you have closed the decoy volume, the Veracrypt volume is ready to be backed up, there you need to add the USB keys to the Whonix Workstation VM like so:
And you need to copy the "diary" file to a server (wherever you want online), and then copy the file on your mainpc, your laptop and then you can also put it on a usb key to be hidden somewhere.
If you want to automate the backup process, place the following backup.sh bashscript inside the whonix VM:
[ Whonix ] [ /dev/pts/2 ] [~]
→ cat backup.sh
#!/bin/bash
#QEMU setting:
#whonix workstation configuration > Controller USB 0 > USB 2
# add each USB as host usb passthrough
#mount all 3 usb sticks:
sudo mkdir /mnt/usb1
sudo mkdir /mnt/usb2
sudo mkdir /mnt/usb3
sudo mount /dev/sda1 /mnt/usb1
sudo mount /dev/sdb1 /mnt/usb2
sudo mount /dev/sdc1 /mnt/usb3
#mount the veracrypt volume to add new diary:
echo "[+] Mount DECOY volume, to add new diary:"
veracrypt --mount /home/user/diary
vim /media/veracrypt1/$(date --iso-8601).txt
echo '[+] DIARY COMPLETE:'
ls -lash /media/veracrypt1
#mount the veracrypt volume to add new diary:
echo "Mount remounting volume, to backup critical data:"
veracrypt --dismount /home/user/diary
veracrypt --mount /home/user/diary
#backup whats critical in the veracrypt volume:
cp -r /home/user/.gnupg /media/veracrypt1/
cp -r /home/user/.ssh /media/veracrypt1/
cp -r /home/user/backup.sh /media/veracrypt1/
cp -r /home/user/Passwords.kdbx /media/veracrypt1/
ls -lash /media/veracrypt1
echo '[+] CRITICAL DATA ADDED TO VERACRYPT, BACKING IT UP TO USB STICKS:'
veracrypt --dismount /home/user/diary
sudo cp -r /home/user/diary /mnt/usb1/diary
sudo cp -r /home/user/diary /mnt/usb2/diary
ls -lash /mnt/usb*
echo '[+] CRITICAL DATA BACKUP ON the 3 USB STICKS COMPLETE, UNMOUNTING...'
sudo umount /mnt/usb1
sudo umount /mnt/usb2
#sudo umount /mnt/usb3
echo '[+] REMOTE BACKUP'
rsync /home/user/diary remoteserver:/root/diary -razP
echo '[+] REMOVING LOGS'
echo '' > ~/.histfile
sudo rm /var/log/*.log /var/log/*/*.log
sudo dmesg -c
echo '[+] SENSITIVE BACKUP COMPLETED, NOW HIDE ALL 3 IN HIDDEN LOCATIONS, UNMOUNTING...'
For instance, you can backup your critical files in places that you own (your apartment, your car, on your keyring), but these places can be found easily. If you want to actually hide (and be able to claim that there are no more copies of your USB keys), get the USB keys in places totally unrelated to you, get creative such as burying the usb key somewhere you can remember, far away from your home, or hiding the file in a remote server, in a location that you remember.
Like so you're covered in case if you are forced to give away your password, and in case if an adversary takes your harddrives, USB keys (minus the ones you managed to hide elsewhere), and if the adversary fills the decoy partitions of your veracrypt volumes in an attempt to destroy the hidden partitions, even in that case, you can still recover your data from the remaining places you successfully managed to hide your data to.
Get creative as to how you choose to hide the veracrypt volume aswell, such as replacing a random linux binary in the /bin/ folder, or a library in /lib, or a file in /etc/, burying the usb key somewhere underground, etc
