dfm covers

Data Hiding in Slack Space

Data Hiding in Slack Space

One of the most important topics in Digital Forensics is data hiding. The black hats continually look for methods with which to plant data in ways that you, the investigator,

cannot find. It is almost like a perpetual catand-mouse game. Just when you think you know how to find their secrets, they find new ways to hide them. The data might be a list of passwords, credit cards numbers, or maybe the secret plans for a bomb. In this article we examine a technique for hiding data in file slack. First, you will learn the theoretical underpinnings of the technique. Then, you will understand an open-source program that was specially written for this article.

To get the discussion started, we need to talk about the topology of data on storage devices. The smallest and most granular unit is a bit. In RAM, single transistors represent bits. On magnetic storage devices, discreet units of magnetic matter represent bits. Eight bits are organized into a byte, which relates to data types such as ASCII characters. The text “Hello” can be represented by a series of five bytes with numeric values 71, 101, 108, 108, and 111.

Find out more - subscribe to DFM today and read the full article. Or if you're a subscriber, login and read the article online.

Please make cache directory writable.

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

Dr Tim Watson

Dr Tim Watson is the head of the Department of Computer Technology at De Montfort University


Coming up in the Next issue of Digital Forensics Magazine

Coming up in Issue 37 on sale from November 2018:

Crowd Sourcing Digital Evidence The Risk v The Reward

All digital devices used today can be considered as a potential source for digital evidence. Andrew Ryan investigates the current state in the art of crowd sourced digital evidence. Read More »

Recovery of Forensic Artifacts from Deleted Jump-List in Windows 10

Jump-Lists are widely discussed in forensics community since the release of Windows 7 and are having more capabilities to reveal forensics artifacts in Windows 10. Read More »

Subscribe today

Voice Biometrics

This article looks at the research and development in the field of Voice Biometrics and Speech Analytics, specifically Speaker Identification, Language and Gender Identification, Speech-to-Text Transcription, Keyword Spotting, and others. Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the next issue