Huang: The Plausibly Deniable DataBase

* You're using something "normal" like NTFS or ext4, partitioned to occupy the full extent of the drive. Then you probably don't have any secret crypto stuff (but see last bullet).
* You're using something mildly unusual, like XFS or ZFS, partitioned to occupy the full extent of the drive. Then you probably don't have any secret crypto stuff, but we'll take a full disk image anyway because we can tell the politicians that your system "looked suspicious" and thereby get away with it.
* You have a large (>10 MiB or so) unpartitioned space on your drive. Then you probably have some secret crypto stuff in there (regular users partition most or all of their space), and we're going to proceed under the assumption that you do, regardless of whether we can prove it or not, and tell you to decrypt "everything." If you proceed to decrypt some perfectly innocuous hidden partition without any interesting content, we will assume that you have a second, incriminating partition, which you are keeping from us, and apply whatever consequences would have occurred if you had refused. This is not true deniability.
* You are using a specialized filesystem that facilitates the use of partitioned-but-unallocated space to hide data. As above, this is not true deniability because we can just assume that you have hidden incriminating data (regular users do not use such filesystems).
* Your whole drive is encrypted. Then we'll tell you to decrypt it and proceed as above.
* You have a bunch of high-resolution photos and/or videos, which do not appear to be encrypted at all, and which appear to be innocuous (e.g. photos of the beach, wildlife, plants, family members, etc.). This is arguably the hardest case for the adversary, because you might just be a random tourist, or you might be using file-level steganography to hide encrypted data in the "random" photographic noise which these files will inevitably contain. The drawback is that this is rather inefficient for large volumes of data, and also you can't (shouldn't) use stock photos because it may be possible to find them with a reverse image search (and prove that you didn't take them yourself). Worse, if the adversary can obtain the originals by any means, they can do a binary diff to recover the (encrypted) contents of your hidden data. So you must create the images yourself and destroy the originals as thoroughly as is practical. That's not particularly hard, but it is a minor hassle, especially if you're going to do this repeatedly with differing data against the same adversary (they can keep copies of the images and compare them across multiple inspections, so image reuse is probably unsafe).

The bottom line: You're not deniable unless your data looks indistinguishable to a normal user's data. Normal users don't use tools like PDDB, so "Does the system have PDDB installed?" is already a decently good proxy for "Is the user trying to hide something?", and there's just no practical way around that.

No, but if you choose to be a good bunnie and use that Precursor device I'll no doubt read all about you on the world's front pages in a few years.