Title: 4. Addressing Data-hiding Techniques
Course: IN 2005 Digital Forensics > Section: Module 9: Chapter 9 - Computer Forensics Analysis and Validation

Addressing Data-hiding Techniques

1. Data hiding involves changing or manipulating a file to conceal information.
2. Data-hiding techniques include hiding entire partitions, changing file extensions, setting file attributes to hidden, using encryption and setting up password protection.

Hiding Partitions

1. You should account for all disk space when analyzing a disk.  See Figures 9-8 and 9-9.

Bit-shifting

1. Bit-shifting is an old technique that shifts bit patterns to alter byte values of data and makes files look like binary executable code.
2. Hex Workshop can be used to shift bits on any file.  See Figures 9-10 through 9-12.

Using Stenography

1. Steganography tools were created to protect copyrighted material by inserting digital watermarks into a file.
2. A suspect can hide information on image or text document files.  Most steganography programs can insert only small amounts of data into a file.
3. Data hidden using this technique is very hard to find without prior knowledge.

Examining Encrypted Files

1. Problems you may encounter when analyzing a data encrypted file and the techniques available for recovering data without a password or passphrase, including:
  - Key escrow
  - Cracking passwords
  - Persuade suspect to reveal password

Recovering Passwords

1. Main techniques for finding passwords:
  - Dictionary attack
  - Brute-force attack
  - Profile attack
2. Some of the tools used to recover passwords, including:
  - AccessData PRTK
  - Advanced Password Recovery Software Toolkit
  - John the Ripper
3. AccessData offers a tool called Password Recovery Toolkit (PRTK) designed to create possible password lists from many sources. See Figures 9-13 and 9-14.
4. With PRTK, you can create your own custom dictionary based on facts in the case.  You can also create a profile of a suspect and use that biographical information to generate likely passwords.  See Figure 9-15.
5. FTK can identify known encrypted files and those that seem to be encrypted and export them. You can then import these files into PRTK and attempt to crack them.  See Figures 9-16 and 9-17.