Lecture 9: File Hiding and Digital Forensics

Hiding Data Techniques and Digital Forensics

Motivation for Hiding Data

• Cybercriminals are risk averse THEY WANT TO AVOID PROSECUTION

• They aim to avoid accountability, incriminating evidence, and prosecution.

• They want to make investigations difficult and time-consuming.

Methods to Hide Data

• In digital forensics, the following are common data hiding techniques used to conceal digital evidence from users or investigators:

  🗂 1. Deep Nesting

  • Definition: Hiding files inside many layers of directories to make them hard to find.

  • Purpose: Exploit OS limitations (e.g., path length) or slow down manual searches.

  • Example: C:\A\B\C\...\Z\hidden_file.docx

  • Detection: Use forensic tools with recursive scanning to traverse all folders.

  📝 2. Hidden Texts & Links

  • Definition:

    • Hidden texts: Data concealed in documents using white font, small sizes, or hidden layers.

    • Hidden links: Hyperlinks embedded in images, spaces, or non-obvious characters.

  • Purpose: Hide messages or external data references in plain sight.

  • Example: A white-colored link on a white background in a Word document.

  • Detection: Analyze document metadata and content rendering with forensic viewers.

  ⚙ 3. Setting Attributes

  • Definition: Changing file or folder attributes to make them invisible or less noticeable.

  • Purpose: Prevent casual users from seeing the file.

  • Example: Using attrib +h +s on Windows to hide a file and mark it as a system file.

  • Detection: Forensic tools list all files regardless of attributes.

  💽 4. Exploiting File Layout

  • Definition: Hiding data in unused or overlooked parts of the file system.

  • Methods include:

    • JPEG Files: Adding data after the footer (0xFF D9) which is the end of the image.

      • Image applications only display the image, while hex editors reveal hidden ASCII characters.

    • .exe Files: Utilizing unused space in the Portable Executable (PE) file layout.

  • Detection: Requires low-level disk analysis, file carving, and metadata inspection.

  ✅ Summary

  In digital forensics, deep nesting, hidden texts & links, setting attributes, and exploiting file layout are techniques used to hide data within the file system or digital documents, often to avoid detection during casual inspection — but can be uncovered through specialized forensic tools and analysis.

• NTFS Streams

• Hiding data: file Alternate Streams:

• In digital forensics, Alternate Data Streams (ADS) are a feature of the NTFS (New Technology File System) that can be used to hide data inside files without affecting the file’s visible content or size — making them a powerful method for data hiding.

  📂 What Are NTFS Alternate Data Streams (ADS)?

  • Primary stream: The main, visible content of a file.

  • Alternate stream: Hidden data attached to the same file, stored using the syntax filename:streamname.

    Why It’s Used for Hiding Data

    • Does not show up in directory listings.

    • File size does not reflect the hidden stream.

    • Bypasses casual inspection and some basic forensic scans.

    🧪 How Forensics Detects ADS

    • Specialized forensic tools like FTK, Autopsy,
      or use stream.exe utility from Microsoft to detect, visualize, and delete alternate streams.

    • Example command: stream.exe MyFile.txt

  • Legitimate use:

  • “Applications can create additional named streams and access the streams by referring to their names. This feature permits related data to be managed as a single unit.
    For example, a graphics program can store a thumbnail image of bitmap in a named data stream within the NTFS file containing the image.”

  • storing thumbnail images within the same file.

  • While ADS can be abused, they also support real features in Windows, especially around file metadata, compatibility, and security.

  FILE TYPE & FILE EXTENSION

• File Extension Manipulation:

  1. Windows uses file extensions to infer file type and associated applications.

  • here are a few types of executable files determined by their extension (e.g., .exe, .bat, .cmd)

  • –  As a rule of thumb, the user can “open” any file with the application that is associated with that file type by double‐ clicking on it

    2.Linux kernel OS is file extension agnostic, (a) It determines applications from file signatures, (b) Changing file extensions does not make any difference (c ) However, Linux desktop environments (e.g., GNOME, KDE) may use file extension to associate file extension with applications

Windows : File type & File Extension

• The OS can be tricked into treating a file as a different format

• Until not long ago (e.g.,inWindows7),Microsoft used to hide extensions by default

  – they reverted to show them by default after pitfalls (e.g., for Windows 10)

• Hiding file extensions by default:

  – Aimed to make manipulation more difficult

  – Aimed to prevent users from “losing” content by accidently changing file extensions

Hiding Content: File type

Hiding file extension by default was exploited to deliver malware

• Example:the ransomware called RAA (Ducklin,2016) – The malware was sent as a attachment
– Attachment appeared as invoice.txt
– In fact, it was a JavaScript invoice.txt.js

File Signatures

• In Windows, the OS uses file extension to list files and to associate them with applications by default

  • ...whereas the applications themselves use file signatures to process file content

  – Different file formats have specific headers (and/or footers) – they are file signatures; sometimes called “magic numbers”

• Applications use file signatures (magic numbers) to process file content.

• Different file formats have specific headers and/or footers.

• JPEG Example: Well-formed JPG files have a signature of 0xFF D8 FF E0 (or E1).

Hiding Content with File Signature Tampering

• File signatures can be manipulated to hide content.

• Changing a file's signature (e.g., from JPG to PDF) can prevent thumbnail display automatically.

• The underlying content remains intact and can be recovered by reverting to the correct signature.

• So, someone could use this trick to hide the content of an incriminating image from the OS (and other users)

File Signature Analysis in Digital Forensics

From the perspective of Digital Forensics ,file signature & file extension are both valuable if the OS of the machine under investigation is Windows

– Some questions which arise, however, are:

1. How to interpret both together?

2. How can they help in investigations?

• Range of Outcomes of File signature analysis:

  • 1.Match: File signature and extension are both in the database and consistent.

  • 2.Alias: File signature and extension are in the database but do not match, or the file lacks an extension but has a recorded signature.

  • 3.Bad Signature: The file signature isn't in the database, but the extension is.

  • 4.Unknown: Neither signature nor extension are in the database.

Hiding Data & Digital Forensics (What are the outcomes the investigator should care about in particular?)

• Detecting and recovering hidden content is crucial in investigations. (typically, recovery is done automatically by DF tools)

• Actions taken to hide data may mean that the criminal wanted to evade automatic detection (e.g., in case of malware)

• Hiding data indicates an attempt to evade detection and reveals the perpetrator's state of mind, which, together with the recovered content hidden and other corroborating evidence, will help toreconstruct a crime answering investigative questions

Other Uses of File Signature in DF

• File/Data Carving: Recovering files or fragments from unallocated clusters/raw data.

  • Steps:

    1. Locate the file beginning using the file signature (header).

    2. Locate the file end using the file signature (footer) or known file size.

    3. Select data between the start and end of the file.

    4. Copy to a new file in a Hex editor and the “save as”