Scribd
Upload
23 views2 pages

Data Hiding Techniques

Uploaded by

Shiva Prasath
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
23 views2 pages

Data Hiding Techniques

Uploaded by

Shiva Prasath
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Raw format image files don't contain metadata such as hashes!

o You must validate them manually to ensure integrity


o Tools such as ProDiscovereve filescontain metadata that includeshash value
o If the Auto Verify Image Checksum and the hashes in the .eve file's metadata don't
match
ProDiscoverwill notifythat the acquisition is corrupt and can't be considered
reliable evidence

Addressing data-hiding techniques

• Data hiding - changing or manipulating a file to conceal information


Techniques
O Hiding entire partitions
O Changing file extensions
O Setting file attributes to hidden
O Bit-shifting
O Using encryption
O Setting up password protection

Hiding files by using the OS

One of the first techniquesto hide data


o Changing file extensions
Advanced digital forenslcs tools check file headers and would flag this
Another hiding technique
o Select the hiddenattribute in a file's propertiesdialog box
Also not very successful unless hiding things form investigator

Hiding partitions

By using the Windows diskpart remove letter command


o You can unassign the partition's letter,which hides it from view in File Explorer
o Of course, it's not hidden from drive management tools, so investigatorswould
check for this
Another known reason for knowing drive total size!

Marking Bad Clusters

• A data-hidingtechnique used in FAT file systems is placing sensitiveor incriminatingdata in


free or slack space on disk partition clusters
o Involvesusing old utilitiessuch as Norton DiskEdit
Can mark good clusters as bad clusters in the FAT table so the OS considers them unusable
o Only way they can be accessed from the OS is by changing them to good clusters
with a disk editors

Bit-shifting

Some users use a lowlevel encryption program that changes the order of binary data
o Makes altereddata unreadable To secure a file, users run an assembler program
(also called a "macro") to scramble bits
O Run another program to restore the scrambled bits to their original order
Bit shifting changes data from readable code to data that looks like binary executable code
WinHex includes a feature for shifting bits

Understanding Steganalysis Methods

Steganography - comes from the Greek word for "hidden writing"


o Hiding messages in such a way that only the intended recipient knows the message is
there
Steganalysis - term for detecting and analysing steganography files
Digitalwatermarking - developed as a way to protect file ownership
o Usually not visible when used for steganography

Examining Encrypted Files

To decode an encrypted file


O Users supply a password or passphase
Many encryption programs use a technology called "key escrow"
o Designed to recover encrypted data if users forget their passphrases or if the user
key is corrupted after a system failure
Key sizes of 128 bits to 4096 bits make breaking them nearly impossible with current
technology

Recovering Passwords

Password-cracking tools are available for handling password protected data or system
o Some are integrated into digital forensics tools
Stand-alone tools:
0 Last Bit
o AccessData PRTK
0 Ophcrack
0 John the Ripper
0 Passware
Brute-force attacks
o Use every possible letter, number and character found on a keyboard
o This method can require a lot of time and processing power
Dictionary attack
o Uses common words found in the dictionary and tries them as passwords
o Most use a variety of languages

Understanding the importance of reports

Communicate the results of your investigation


o Including expert opinion
Forensic reports can
o Provide justification for collecting more evidence
o Be used at a probable cause hearing
o Communicate expert opinion
Many courts require expert witnesses to submit written reports

You might also like