Data Hiding Tactics for Windows and Unix File Systems

flinchlock · May 25, 2007

This is a MUST READ!

Data Hiding Tactics for Windows and Unix File Systems by Hal Berghel, David Hoelzer, Michael Sthultz

(My bolding)

Every hard drive using a DOS partition has space reserved at the beginning of the drive for a Master Boot Record (MBR) (see Figure 1, item 2). This will often contain the boot code necessary to begin the initial program load of an operating system and will always contain a partition table (provided we are dealing with partitioned media; e.g., floppy disks are not typically partitioned media while fixed disks are) defining the size and location of up to four partitions. Since the MBR only requires a single sector and partitions must start on a cylinder boundary, this results in 62 sectors of empty MBR space where data can be hidden.
Click to expand...

As disk sizes grew beyond the limitations of existing operating systems, there arose a need for more than four partitions on a single hard disk. Extended partitions (as opposed to primary partitions) were then designed that could contain multiple logical partitions. Each of these extended partitions contains a structure similar to the MBR, leaving another 62 sectors within each extended partition with the potential of harboring more hidden data. Extended partitions may contain at most one file system and one extended partition, so this design permits us to nest the extended partitions to satisfy our volume requirements. Of course, each iteration creates yet another convenient hiding place for data.
Click to expand...

Many of those that attempt to temporarily hide data or use a computer with nefarious intent are aware that there are ways in which this hidden data can be found. They will therefore use one of the available "disk wiper" utilities in an attempt to eliminate the evidence. What they are not aware of is that many of these utilities are ineffective in eliminating all hidden data.
Click to expand...

Finding hidden data is further complicated by the fact that there are a number of anti-forensic tools being developed. One source is the research being done by the Metasploit Project ( www.metasploit.com/projects/antiforensics ). An example is their Slacker tool that automatically encrypts and hides a set of data within the slack space of multiple files that are known to be unlikely to be changed. Data thus hidden cannot be detected by currently available digital forensic analysis software.
Click to expand...

Mike

ErikAlbert · May 25, 2007

They will therefore use one of the available "disk wiper" utilities in an attempt to eliminate the evidence. What they are not aware of is that many of these utilities are ineffective in eliminating all hidden data.
Click to expand...

Why is it so difficult to write a "disk wiper" software that DOES its job completely ?
What is the problem : the programmer or the complexity to remove hidden data safely without hurting the rest ?

flinchlock · May 25, 2007

ErikAlbert said:

Why is it so difficult to write a "disk wiper" software that DOES its job completely ?
What is the problem : the programmer or the complexity to remove hidden data safely without hurting the rest ?
Click to expand...

I also do not understand that... but I would be more inclined to trust the wiper software from the drive manufacture.

Mike

steve161 · May 25, 2007

What is the problem : the programmer or the complexity to remove hidden data safely without hurting the rest ?
Click to expand...

My not too knowledgable opinion would be the latter. With the growing popularity of these programs, I would think there would be a financial incentive in developing a program that can claim complete removal of hidden data.

Log in or Sign up

Data Hiding Tactics for Windows and Unix File Systems

flinchlock Registered Member

ErikAlbert Registered Member

flinchlock Registered Member

steve161 Registered Member

Log in or Sign up

Data Hiding Tactics for Windows and Unix File Systems

flinchlock Registered Member

ErikAlbert Registered Member

flinchlock Registered Member

steve161 Registered Member

Useful Searches