I dont know whether this question belongs here, but I wasnt creative enough to figure out if there was a better place, so here it goes

On the Jondonym live CD truecrypt is installed. I have a truecrypt container located on a ntfs partition in a Windows environment. Unfortunately every time I access the container using the live CD, the date accessed of the container is updated. This does not happen when I open the container under windows. And I guess the latter is, for privacy reasons, how it should be. So why does Truecrypt on the live CD change the date accessed?

It seems, it is not related to Truecrypt but to the NTFS-3G driver of linux. The file system driver sets an access timestamp, if the container wa opened by Truecrypt. It is not possible for Truecrypt (Linux version) to modify this behaviour, because Truecrypt for Linux uses the file system API and can nt access files on a NTFS partition with low level routines.

May be, you can mount the NTFS partition without update of acces time. You may try to add the option "noatime" to the mount options. For setting the mount options see: https://anonymous-proxy-servers.net/en/ ... e-cd8.html

"noatime" will avoid the record of read access. In case of write accress, the timestamp will be updated.

Thanks for your answer Cane. So it is the NTFS-3G driver. Unfortunately there are 8 timestamps in the MFT for a file and unexpected behaviour of the driver might result in inconsistities. Journaling file systems are bad for privacy.

I will expirement some more.