2

I understand that in some countries, electronic devices can be searched at customs and border check points. I would like to understand how this check is done technically.

I.e., do they just turn it on, just for my password, type it in and then browse around? Or do they connect (how? USB?) a storage device with a program that scans the hard drive (file system? sectors?) for things they search for?

Also, what are they searching for, and how? Text? Images? Documents? Do they have a list of known fingerprints, hashes, file names? Or is it heuristics (jpg with lots of skin tone => child pornography?). Do they also copy stuff off in this manner, or do they disassemble the laptop and put the disk in a clone devices?

What operating systems and file systems are they prepared for? E.g., would XFS on a loop device on EXT4 stump them completely?

What are their means of detecting hidden, encrypted and/or steganographised volumes, vaults, partitions or file contents (e.g. steganography in a bitmap)? Are they prepared for common solutions (TrueCrypt, luks etc.) only, or do they employ methods to detect other custom solutions (analysing bit patterns in unused sectors, signal-to-noise ratio in pictures etc.)?

Countries I'm looking at are US and UK.

(Lots of questions, I know. Blame my curiosity.)

|improve this question
  • 3
    The question as it is, although is a good question, may be too broad. Do you have any specific country in mind? It is very likely that each country has its own set of rules/laws. e.g. if we limit the discussion to USA (most of the online horror stories are from there): Are CBP officers allowed to search and clone media devices? or a similar question – Newton Oct 16 '18 at 13:30
  • Thanks for the comment and the links. I've edited the questions to include the countries I'm looking at. – Date Traveller Oct 16 '18 at 14:52
  • 1
    This does not answer your technical question but when arriving in the UK from Amsterdam I was asked if I had any images on my laptop and when i said yes was asked if I understood that some images were inappropriate. When I confirmed I did understand that, he let me through without looking at the laptop nor asking me to further define inappropriate. – mdewey Oct 16 '18 at 15:50
  • First, 99.999% of travelers don't need to worry about this. Then, it will depend greatly on why they suspect you. If they find evidence of a likely overstay from txt messages, they'll likely stop there and send you back. – Johns-305 Oct 16 '18 at 21:52