This afternoon, Dark Reading reports:

Schneier, Team Hack 'Invisibility Cloak' for Files
Researchers break 'deniable file system' steganography feature that conceals the existence of sensitive files from hackers
JULY 16, 2008 | 5:35 PM

By Kelly Jackson Higgins
Senior Editor, Dark Reading

[...]
The researchers were able to get around DFS in versions 5.0 and below of TrueCrypt’s encryption-on-the-fly tool, and will present their findings on the hack at the Usenix HotSec ’08 summit next week in San Jose, Calif.

[...]
Schneier, who has studiedthe viability of the so-called “deniable” file system model in the past, says DFS is actually easier to hack than encryption, and that there may be no way to make files truly undetectable on a drive. “Deniability is a much harder security feature to enable than secrecy,” he says. [...]

The researchers were able to crack DFS without decrypting it. “Breaking the security of a DFS does not require decrypting the data; it only requires proving that (or in some cases simply providing strong evidence that) the encrypted data exists,” according to the report, which was co-authored by Schneier and University of Washington researchers Alexei Czeskis, David St. Hilaire, Karl Koscher, Steven Gribble, and Tadayoshi Kohno.

The researchers found that Windows Vista shortcuts can give away the existence of a hidden file. Vista, which automatically creates shortcuts to files that get used, then stores the shortcuts in the Recent Items folder. And the auto-save feature in Word, meanwhile, saved versions of the hidden files.

[...]
“Modern applications and operating systems are very complicated, and interact with each other in many different ways,” Schneier says. “Hiding the existence of something means controlling all those interactions, which turns out to be a very hard problem.”

Quite interesting. I am looking forward to the presentation whenever it becomes available on the USENIX Conference Proceeding site.

Related reference: Truecrypt's explanation of its Plausible Deniability approach.

UPDATE (17 July 2008):
Bruce Schneier & UW team's research paper "Defeating Encrypted and Deniable File Systems: TrueCrypt v5.1a and the Case of the Tattling OS and Applications" is now available at
http://www.cs.washington.edu/research/security/truecrypt.pdf
and
http://www.schneier.com/paper-truecrypt-dfs.html

Although Schneier has not yet mentioned the paper on his blog, some comments about Truecrypt and plausible deniability appear under his recent post "Using a File Erasure Tool Considered Suspicious".

I sometimes slip in "deniable plausibility"; it's hard to believe,
J.D. Abolins