안티포렌식을 위해 비트보정 기법을 사용한 타임스탬프에 데이터 숨기기 방법
A Steganographic Data Hiding Method in Timestamps by Bit Correction Technique for Anti-Forensics
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this research, a bit correction technique of data hiding method in timestamp of MFT entry in NTFS file system is proposed. This method is proposed in two ways, depending on the number of bytes of data to hide. A basic data hiding method using a bit correction technique to solve the problems of the conventional 2-byte technique is proposed. In order to increase the capacity of the data, a 3-byte data hiding method using an extended bit correction technique is proposed. The data hiding method in the timestamps is based on the fact that is not revealed in the Windows explorer window and the command prompt window even if any data is hidden in the timestamp area of less than one second. It is shown that the validity of the proposed method through the experimental two cases of the basic data hiding method by the bit correction method and the 3-byte data hiding method by the extended bit correction method.
Abstract
In this research, a bit correction technique of data hiding method in timestamp of MFT entry in NTFS file system is proposed. This method is proposed in two ways, depending on the number of bytes of data to hide. A basic data hiding method using a bit correction technique to solve the problems of the conventional 2-byte technique is proposed. In order to increase the capacity of the data, a 3-byte data hiding method using an extended bit correction technique is proposed. The data hiding method in the timestamps is based on the fact that is not revealed in the Windows explorer window and the command prompt window even if any data is hidden in the timestamp area of less than one second. It is shown that the validity of the proposed method through the experimental two cases of the basic data hiding method by the bit correction method and the 3-byte data hiding method by the extended bit correction method.
참고문헌 (15)
- N. A. Hassan, "Data Hiding Techniques in Windows OS" (2017), Elsevier
- Ewa Huebner, "Data hiding in the NTFS file system", Digital Investigation, 3(4), pp.211~226 (2006)[DOI]
- 조규상, "새로운 NTFS 디렉토리 인덱스 안티포렌식 기법", 한국정보전자통신기술학회 논문지, 8(4), pp.327~337 (2015), 한국정보전자통신기술학회
- Fu-Hau Hsu, "Data concealments with high privacy in new technology file system", The Journal of Supercomputing, 72(1), pp.120~140 (2016), Springer Nature[DOI]
- 조규상, "Data Hiding in NTFS Timestamps for Anti-Forensics", The International Journal of Internet, Broadcasting and Communication, 8(3), pp.31~40 (2016), 한국인터넷방송통신학회[DOI]
- Sebastian Neuner, "Time is on my side: Steganography in filesystem metadata", Digital Investigation, 18, pp.S76~S86 (2016), Elsevier BV[DOI]
- Thomas Göbel, "Anti-forensics in ext4: On secrecy and usability of timestamp-based data hiding", Digital Investigation, 24, pp.S111~S120 (2018), Elsevier BV[DOI]
- B. Carrier, "File System Forensic Analysis", pp.273~396 (2005), Addison-Wesley
- "INFO: Working with the FILETIME Structure"[URL]
- Gyu-Sang Cho, "A computer forensic method for detecting timestamp forgery in NTFS", Computers & Security, 34, pp.36~46 (2013), Elsevier BV[DOI]
- Timestomping NTFS, IMSc final research project report, "Wicher Minnaard", University of Amsterdam, Faculty of Natural Sciences, Mathematics and Computer Science, ~ (2014)
- "Metasploit Anti Forensics Project"[URL]
- "SetMace"[URL]
- Chu Luo, "A Data Hiding Approach for Sensitive Smartphone Data", Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing (2016)
- T. Knutsson, "Filesystem Timestamps: What Makes Them Tick?", pp.1~27 (2016), SANS Institute InfoSec Reading Room