Browse > Article

An Anti-Forensic Technique for Hiding Data in NTFS Index Record with a Unicode Transformation  

Cho, Gyu-Sang (동양대학교/컴퓨터정보전학과)
Publication Information
Convergence Security Journal / v.15, no.7, 2015 , pp. 75-84 More about this Journal
Abstract
In an "NTFS Index Record Data Hiding" method messages are hidden by using file names. Windows NTFS file naming convention has some forbidden ASCII characters for a file name. When inputting Hangul with the Roman alphabet, if the forbidden characters for the file name and binary data are used, the codes are convert to a designated unicode point to avoid a file creation error due to unsuitable characters. In this paper, the problem of a file creation error due to non-admittable characters for the file name is fixed, which is used in the index record data hiding method. Using Hangul with Roman alphabet the characters cause a file creation error are converted to an arbitrary unicode point except Hangul and Roman alphabet area. When it comes to binary data, all 256 codes are converted to designated unicode area except an extended unicode(surrogate pairs) and ASCII code area. The results of the two cases, i.e. the Hangul with Roman alphabet case and the binary case, show the applicability of the proposed method.
Keywords
Data Hiding; Directory Index; Digital Forensics; Windows NTFS; B-tree;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 Michael T. Raggo, Chet HosmerB, 'Data Hiding: Exposing Concealed Data in Multimedia, Operating Systems', Syngress, 2013.
2 H. Carvey, 'Windows Forensics and Incident Recovery', 2005.
3 Metasploit, Anti Forensics Project, http://www.metasploit.com/research/projects/antiforensics/
4 I. Thompson and M. Monroe, "FragFS: An Advanced Data Hiding Technique", BlackHat Federal, 2006.
5 S. Piper et.al, "Detecting hidden data in EXT2/EXT3 file systems", Advances in Digital Forensics, pp. 245-256, 2006.
6 E. Huebner, D. Bem and C. K. Wee, "Data hiding in the NTFS file system", Digital Investigation, Vol. 3, Issue 4, pp. 211-226, 2006.   DOI
7 Gyu-Sang Cho, "NTFS Directory Index Analysis for Computer Forensics", IMIS 2015, Blumenau Brazil, 2015.
8 조규상, "새로운 NTFS 디렉토리 인덱스 안티포렌식 기법", 한국정보전자통신기술학회 논문지, 8권, 4호, pp.327-337, 2015.
9 Microsoft MSDN, "Naming Files, Paths, and Namespaces", https://msdn.microsoft.com/en-us/library/aa365247
10 Microsoft MSDN, "Surrogates and Supplementary Characters", https://msdn.microsoft.com/ en-us/library/windows/desktop/dd374069