1. Anti-Forensics Hidden Evidence

2. Road Map Steganography Encryption Data Wiping Metadata spoilage Alternative data streams Index.DAT Thumbs.DB Death of Digital Forensics Conclusion Questions

3. Steganography Detection – WetStone Technologies' Gargoyle – Niels Provos' Stegdetect Hiding – StegoMagic – wbStego – HIP (Hide In Picture)

4. StegoMagic

5. wbStego

6. HIP

7. Encryption File encryption Full disc-encryption

8. Data Wiping M-Sweep Pro Data Eliminator DBAN DOD 5220.22M File Shredder Beyond DOD

9. M-Sweep Pro Data Eliminator

10. DBAN

11. File Shredder

12. Metadata spoilage Metaspolit – TimeStomp – Slack Metachanger

13. Metasploit

14. Timestomp

15. MetaChanger

16. Alternative data streams Data fork Resource fork old Macintosh Hierarchical File System Impossible to protect your system against ADS. Cannot be disabled No way to limit this capability redirect [>] and colon [:] to fork one file into another. C:\test> type c:\windows\notepad.exe > ads.txt:hidden.exe

17. Alternate Data Streams scan engine

18. Index.DAT Contains all of the Web sites Every URL Every Web page All email sent or received through Outlook or Outlook Express All internet temp files All pictures viewed

19. Locations of Index.DAT files VISTA \Users\ \AppData\Roaming\Micr osoft\Windows\Cookies\index.dat \Users\ \AppData\Roaming\Micr osoft\Windows\Cookies\low\index.dat \Users\ \AppData\Local\Microso ft\Windows\Temporary Internet Files\Content.IE5\index.dat C:\Users\ \AppData\Local\Micro soft\Windows\History\Content.IE5\index.dat

20. Index.DAT Analyzer

21. Thumbs.DB Pictures opened in Windows OS Filmstrip Thumbnails Thumbs.DB Viewer

23. To Edit Thumbs.DB 1)Open My Computer 2)Click on Tools 3)Click on Folder Options 4)Click on the View Tab 5)Place a check in the option "Do not cache thumbnails“ 6)Click Ok 7)Close My Computer

24. Get rid of Thumbs.DB 1)Click on Start 2)Click on Search 3)Click on All Files and Folders 4)Type the following in the section called "all or part of the file name“ thumbs.db 5)In the Look in box, make sure Local Hard Drives is chosen 6)Click Search 7)A long list of thumbs.db files should appear, click on Edit, Select All 8)Click on File, and choose Delete 9)Close the Search Results window

25. Death of Digital Forensics SSDs are much like memory Smallest part written too is a sector Erases data in a block Anything changes physical placement of data Logical placement stays the same. Black boxes from a system's point of view Property

26. Conclusion Believe it or not Easy to hide data Need not be a hacker Simple tools Open source Encrypt Erase not delete

27. Questions