AntiForensics Hidden Evidence Road Map Steganography Encryption Data

Anti-Forensics Hidden Evidence

Road Map • • • Steganography Encryption Data Wiping Metadata spoilage Alternative data streams Index. DAT Thumbs. DB Death of Digital Forensics Conclusion Questions

Steganography • Detection – Wet. Stone Technologies' Gargoyle – Niels Provos' Stegdetect • Hiding – Stego. Magic – wb. Stego – HIP (Hide In Picture)

Stego. Magic

wb. Stego

HIP

Encryption • File encryption • Full disc-encryption

Data Wiping • • M-Sweep Pro Data Eliminator DBAN DOD 5220. 22 M File Shredder Beyond DOD

M-Sweep Pro Data Eliminator

DBAN

File Shredder

Metadata spoilage • Metaspolit – Time. Stomp – Slack • Metachanger

Metasploit

Timestomp

Meta. Changer

Alternative data streams • Data fork Resource fork old Macintosh Hierarchical File System • Impossible to protect your system against ADS. • Cannot be disabled • No way to limit this capability • redirect [>] and colon [: ] to fork one file into another. • C: test> type c: windowsnotepad. exe > ads. txt: hidden. exe

Alternate Data Streams scan engine

Index. DAT Contains all of the Web sites Every URL Every Web page All email sent or received through Outlook or Outlook Express • All internet temp files • All pictures viewed • •

Locations of Index. DAT files VISTA • Users<Username>App. DataRoamingMicr osoftWindowsCookiesindex. dat Users<Username>App. DataRoamingMicr osoftWindowsCookieslowindex. dat Users<Username>App. DataLocalMicroso ftWindowsTemporary Internet FilesContent. IE 5index. dat C: Users<User. Name>App. DataLocalMicro softWindowsHistoryContent. IE 5index. dat

Index. DAT Analyzer

Thumbs. DB • • Pictures opened in Windows OS Filmstrip Thumbnails Thumbs. DB Viewer

Thumbs. DB Viewer

To Edit Thumbs. DB 1) 2) 3) 4) 5) Open My Computer Click on Tools Click on Folder Options Click on the View Tab Place a check in the option "Do not cache thumbnails“ 6) Click Ok 7) Close My Computer

1) 2) 3) 4) 5) 6) 7) 8) 9) Get rid of Thumbs. DB Click on Start Click on Search Click on All Files and Folders Type the following in the section called "all or part of the file name“ thumbs. db In the Look in box, make sure Local Hard Drives is chosen Click Search A long list of thumbs. db files should appear, click on Edit, Select All Click on File, and choose Delete Close the Search Results window

Death of Digital Forensics • • SSDs are much like memory Smallest part written too is a sector Erases data in a block Anything changes physical placement of data Logical placement stays the same. Black boxes from a system's point of view Property

Conclusion • • Believe it or not Easy to hide data Need not be a hacker Simple tools Open source Encrypt Erase not delete

Questions