ITW 3531 Module 7 Assignment

Full Name: Joshua Williams

1. Use a legit method/tool (other than using steganography) to hide data, such as a text file
with some content in it. Then use a legit forensic/security tool to unhide it. Show major
steps using screenshots. (30 points)
Within my school file is text documents
containing the information I used to log into the
various connected accounts. I can’t just let anyone
see it, so I’ve decided to hide it with the tool Wise
Folder Hider.

All I have to do is drag the folder onto WHF’s GUI,

and it will keep the file path in memory so the
user and Windows knows that the files are still
there, just hidden. The hidden Files can still be
accessed via the GUI.

Now the file can’t be seen within windows, all

of my login information is hidden from view
unless WHF is active.

Now
all one has to do to unhide the file is open up
WHF, click the dropdown menu to the far right of
the row, and click ‘Unhide’. The file is once again
visible, upon clicking ‘Close’ the file will be re-
hidden to the user.
2. Demonstrate that you can use a legit password evaluation tool to evaluate/crack a
password where you are fully authorized to do so. The password can be for protecting a file,
such as a Microsoft Office document, or it can be a Windows/Linux user login password. Use
notes and screenshots to show the process. (30 points)

About three months ago, I began working

on a modification to the game Fire Emblem
Three Houses. I backed up all of my progress
to a Zip file and forgot the password I used
to hide it; I have a very snoopy roommate
who tries to peek in on my pet projects from
time-to-time. I launched the tool Passware
and set it to scan the directory in which the
Zip file is located.
Upon scanning the directory, it located the
Encrypted Zip file. I clicked the recover
password button, which resulted in the
installation and usage of the Passware Kit. It
presented several options to recover the
password: Generic default attacks, and a
wizard for those who know something about
the password, as I believed I did, I selected
it.
These are the options it presents, asking me for
the format of the password, the language of the
password, as well as its length. It will then ask
for the pattern, how the characters are
arranged, what if any special or numeric
characters. I set them appropriately to what I
suspect the password should be.

After roughly 50 minutes, with the rough

guesses as to what the password was,
Passware found the password and I was able to
begin decrypting and unpacking my pet
project.
3. Use a legit steganography tool to hide secret (e.g., a sentence stored in a text document) in
a carrier file such as a picture file or an audio file. Then retrieve the secret from the carrier
file. Specify the tool used and show major steps with notes and screenshots. (30 points)

This is an image created by a friend of mine.

Using the tool ImageHide I hid text
containing a link to my music folder on
google drive within this image.

I then used the password ‘fishsticks’ to

encrypt the text within the image.

Using the same tool, I can reopen the image

and click ‘Read Data’, this brings up the
decryption prompt, where I can enter the
password.

Now we can see the hidden text within the

image. If two people were to use ImageHide,
they could pass harmless images with hidden
text data. Images can also be translated into a
text file, and send an image that contains a
second encrypted image.
4. First backup all data on your USB memory key to a safe/secure place as you will use the
memory key for testing data wiping. Then use a legit data destruction/wiping software tool
to permanently eliminate all data on your USB memory key. Finally use a legit digital
forensic tool to examine if there is any data left on the USB memory key. Show screenshots
and provide notes for major steps. (30 points)

This is an old backup of my school

assignments, transcripts, and notes;
It is an outdated backup. I used
EaseUS Partition Manager to
completely wipe the disk for later use
in storing an up-to-date backup.

I select the USB Drive E and selected

to wipe the data and create a new
partition. This process took nearly an
hour and it supposedly wiped all data
from the drive and created an
entirely new partition for usage.

Upon opening the USB Drive (E)

within File Explorer, the USB is
completely wiped of data. I then
opened up Autopsy and confirmed
that there are no files on the drive.
There were eight Orphan files, which
were all created at the same time. I
believe they were a bi-product of
EaseUS trying to create a partition.