• International Journal of Internet, Broadcasting and Communication
• /
• v.9 no.3
• /
• pp.17-26
• /
• 2017

An anti-forensic data hiding method in an NTFS index record is a method designed for anti-forensics, which records data as a file name in index entries and thereafter the index entries are made to remain in the intentionally generated slack area in a 4KB-sized index record[7]. In this paper, we propose a maximum data allocation rule for an anti-forensic data hiding method in an NTFS index record; i.e., a computational method for storing optimal data to hide data in an index record of NTFS is developed and the optimal solution is obtained by applying the method. We confirm that the result of analyzing the case where the number of index entries n = 7 is the maximum case, and show the screen captures of index entries as experimental results.

• Convergence Security Journal
• /
• v.15 no.7
• /
• pp.75-84
• /
• 2015

In an "NTFS Index Record Data Hiding" method messages are hidden by using file names. Windows NTFS file naming convention has some forbidden ASCII characters for a file name. When inputting Hangul with the Roman alphabet, if the forbidden characters for the file name and binary data are used, the codes are convert to a designated unicode point to avoid a file creation error due to unsuitable characters. In this paper, the problem of a file creation error due to non-admittable characters for the file name is fixed, which is used in the index record data hiding method. Using Hangul with Roman alphabet the characters cause a file creation error are converted to an arbitrary unicode point except Hangul and Roman alphabet area. When it comes to binary data, all 256 codes are converted to designated unicode area except an extended unicode(surrogate pairs) and ASCII code area. The results of the two cases, i.e. the Hangul with Roman alphabet case and the binary case, show the applicability of the proposed method.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.8 no.4
• /
• pp.327-337
• /
• 2015

This work provides new forensic techinque to a hide message on a directory index in Windows NTFS file system. Behavior characteristics of B-tree, which is apoted to manage an index entry, is utilized for hiding message in slack space of an index record. For hidden message not to be exposured, we use a disguised file in order not to be left in a file name attribute of a MFT entry. To understand of key idea of the proposed technique, we describe B-tree indexing method and the proposed of this work. We show the proposed technique is practical for anti-forensic usage with a real message hiding case using a developed software tool.

• Journal of the Korea Society of Computer and Information
• /
• v.23 no.8
• /
• pp.85-93
• /
• 2018

In this research, it is proposed that a method to hide data by modifying directory index entry information. It consists of two methods: a directory list hiding and a file contents hiding. The directory list hiding method is to avoid the list of files from appearing in the file explorer window or the command prompt window. By modifying the file names of several index entries to make them duplicated, if the duplicated files are deleted, then the only the original file is deleted, but the modified files are retained in the MFT entry intact. So, the fact that these files are hidden is not exposed. The file contents hiding is to allocate data to be hidden on an empty index record page that is not used. If many files are made in the directory, several 4KB index records are allocated. NTFS leaves the empty index records unchanged after deleting the files. By modifying the run-list of the index record with the cluster number of the file-to-hide, the contents of the file-to-hide are hidden in the index record. By applying the proposed method to the case of hiding two files, the file lists are not exposed in the file explorer and the command prompt window, and the contents of the file-to-hide are hidden in the empty index record. It is proved that the proposed method has effectiveness and validity.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2020.01a
• /
• pp.65-66
• /
• 2020

이 논문에서는 NTFS 파일시스템에서 여러 개의 클러스터에 걸쳐서 슬랙 영역에 데이터 숨기기를 수행하는 데이터 숨기기 방법의 강인성을 조사하기 위하여 디스크 조각모음 실험을 수행할 때 필요한 방법을 제안한다. 디스크 조각모음의 실행으로 클러스터의 위치가 변동되기 위해서는 여러 클러스터에 걸친 디스크 조각의 단편화가 일어날 수 있도록 파일을 생성하고 삭제하는 작업을 수행한다. 그 후에 용량이 큰 파일을 복사하여 여러 클러스터에 걸친 단편화된 파일을 작위적으로 생성한다. 단편화된 파일만을 남기고 그 이외의 다른 파일들을 삭제한 후에 디스크조각 모음을 수행한다. 이 실험에 필요한 준비과정과 실험과정을 제안한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.11 no.4
• /
• pp.69-79
• /
• 2015

This research proposes a modified data hiding method to hide data in a slack space of an NTFS index record. The existing data hiding method is for anti-forensics, which uses traces of file names of an index entry in an index record when files are deleted in a direcotry. The proposed method in this paper modifies the existing method to make non-admittable ASCII characters for a file name applicable. By improving the existing method, problems of a file creation error due to non-admittable characters are remedied; including the non-admittable 9 characters (i. e. slash /, colon :, greater than >, less than <, question mark ?, back slash ${\backslash}$, vertical bar |, semi-colon ;, esterisk * ), reserved file names(i. e. CON, PRN, AUX, NUL, COM1~COM9, LPT1~LPT9) and two non-admittable characters for an ending character of the file name(i. e. space and dot). Two results of the two message with non-admittable ASCII characters by keyboard inputs show the applicability of the proposed method.