A Trusted Platform Module Based Anti-Forensics System

A Trusted Platform Module (TPM) contains a unique identity and provides a range of security functions. This paper outlines a client-server system utilizing a TPM-enabled computer to hinder forensic examination. The system allows for data confidentiality, plausible deniability, and hiding of traces that incriminating data was present on the client. The server will attest the client before allowing it to submit / receive incriminating data, and encrypted incriminating data can only be decrypted 1) by the encrypting client, and 2) if and only if the encrypting client's platform configuration matches that during encryption. The client's state can always be established via measurement results, and they cannot be tampered to fake attestation.