Anti-Forensics Hidden Evidence

Road Map Steganography Encryption Data Wiping Metadata spoilage Alternative data streams Index.DAT Thumbs.DB Death of Digital Forensics Conclusion Questions

Steganography Detection – WetStone Technologies' Gargoyle – Niels Provos' Stegdetect Hiding – StegoMagic – wbStego – HIP (Hide In Picture)

StegoMagic

wbStego

HIP

Encryption File encryption Full disc-encryption

Data Wiping M-Sweep Pro Data Eliminator DBAN DOD M File Shredder Beyond DOD

M-Sweep Pro Data Eliminator

DBAN

File Shredder

Metadata spoilage Metaspolit – TimeStomp – Slack Metachanger

Metasploit

Timestomp

MetaChanger

Alternative data streams Data fork Resource fork old Macintosh Hierarchical File System Impossible to protect your system against ADS. Cannot be disabled No way to limit this capability redirect [>] and colon [:] to fork one file into another. C:\test> type c:\windows\notepad.exe > ads.txt:hidden.exe

Alternate Data Streams scan engine

Index.DAT Contains all of the Web sites Every URL Every Web page All sent or received through Outlook or Outlook Express All internet temp files All pictures viewed

Locations of Index.DAT files VISTA \Users\ \AppData\Roaming\Micr osoft\Windows\Cookies\index.dat \Users\ \AppData\Roaming\Micr osoft\Windows\Cookies\low\index.dat \Users\ \AppData\Local\Microso ft\Windows\Temporary Internet Files\Content.IE5\index.dat C:\Users\ \AppData\Local\Micro soft\Windows\History\Content.IE5\index.dat

Index.DAT Analyzer

Thumbs.DB Pictures opened in Windows OS Filmstrip Thumbnails Thumbs.DB Viewer

To Edit Thumbs.DB 1)Open My Computer 2)Click on Tools 3)Click on Folder Options 4)Click on the View Tab 5)Place a check in the option "Do not cache thumbnails“ 6)Click Ok 7)Close My Computer

Get rid of Thumbs.DB 1)Click on Start 2)Click on Search 3)Click on All Files and Folders 4)Type the following in the section called "all or part of the file name“ thumbs.db 5)In the Look in box, make sure Local Hard Drives is chosen 6)Click Search 7)A long list of thumbs.db files should appear, click on Edit, Select All 8)Click on File, and choose Delete 9)Close the Search Results window

Death of Digital Forensics SSDs are much like memory Smallest part written too is a sector Erases data in a block Anything changes physical placement of data Logical placement stays the same. Black boxes from a system's point of view Property

Conclusion Believe it or not Easy to hide data Need not be a hacker Simple tools Open source Encrypt Erase not delete

Questions