디렉토리 정보를 변조하여 파일시스템에 데이터를 숨기기 위한 방법
A Method of Data Hiding in a File System by Modifying Directory Information
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
In this research, it is proposed that a method to hide data by modifying directory index entry information. It consists of two methods: a directory list hiding and a file contents hiding. The directory list hiding method is to avoid the list of files from appearing in the file explorer window or the command prompt window. By modifying the file names of several index entries to make them duplicated, if the duplicated files are deleted, then the only the original file is deleted, but the modified files are retained in the MFT entry intact. So, the fact that these files are hidden is not exposed. The file contents hiding is to allocate data to be hidden on an empty index record page that is not used. If many files are made in the directory, several 4KB index records are allocated. NTFS leaves the empty index records unchanged after deleting the files. By modifying the run-list of the index record with the cluster number of the file-to-hide, the contents of the file-to-hide are hidden in the index record. By applying the proposed method to the case of hiding two files, the file lists are not exposed in the file explorer and the command prompt window, and the contents of the file-to-hide are hidden in the empty index record. It is proved that the proposed method has effectiveness and validity.
Abstract
In this research, it is proposed that a method to hide data by modifying directory index entry information. It consists of two methods: a directory list hiding and a file contents hiding. The directory list hiding method is to avoid the list of files from appearing in the file explorer window or the command prompt window. By modifying the file names of several index entries to make them duplicated, if the duplicated files are deleted, then the only the original file is deleted, but the modified files are retained in the MFT entry intact. So, the fact that these files are hidden is not exposed. The file contents hiding is to allocate data to be hidden on an empty index record page that is not used. If many files are made in the directory, several 4KB index records are allocated. NTFS leaves the empty index records unchanged after deleting the files. By modifying the run-list of the index record with the cluster number of the file-to-hide, the contents of the file-to-hide are hidden in the index record. By applying the proposed method to the case of hiding two files, the file lists are not exposed in the file explorer and the command prompt window, and the contents of the file-to-hide are hidden in the empty index record. It is proved that the proposed method has effectiveness and validity.
참고문헌 (16)
- Michael T. Raggo, "Data Hiding: Exposing Concealed Data in Multimedia, Operating Systems, Mobile Devices and Network Protocols" (2012), Syngress
- N. A. Hassan., "Data Hiding Techniques in Windows OS" (2017), Elsevier
- "Metasploit Anti Forensics Project"[URL]
- I. Thompson, "FragFS: an advanced data hiding technique" (2006), BlackHat Federal
- Piper, "Advanced in Digital Forensics", pp.245~256 (2005), Springer
- Ewa Huebner, "Data hiding in the NTFS file system", Digital Investigation, 3(4), pp.211~226 (2006), Elsevier BV[DOI]
- 조규상, "Data Hiding in NTFS Timestamps for Anti-Forensics", The International Journal of Internet, Broadcasting and Communication, 8(3), pp.31~40 (2016), 한국인터넷방송통신학회[DOI]
- Sebastian Neuner, "Time is on my side: Steganography in filesystem metadata", Digital Investigation, 18, pp.S76~S86 (2016), Elsevier BV[DOI]
- Thomas Göbel, "Anti-forensics in ext4: On secrecy and usability of timestamp-based data hiding", Digital Investigation, 24, pp.S111~S120 (2018), Elsevier BV[DOI]
- P. Grd., "Analysis of B-tree data structure and its usage in computer forensics", Proc. of the 21st Cent. Euro. Conf. on Infor. and Intelli. Sys., pp.423~428 (2010)
- 조규상, "일반 B-트리와 NTFS B-트리의 비교: 디지털포렌식 관점에서", 한국컴퓨터정보학회논문지, 22(8), pp.73~83 (2017), 한국컴퓨터정보학회[DOI]
- 조규상, "새로운 NTFS 디렉토리 인덱스 안티포렌식 기법", 한국정보전자통신기술학회 논문지, 8(4), pp.327~337 (2015), 한국정보전자통신기술학회
- A. Srinivasan, "Steganographic information hiding that exploits a novel file system vulnerability", Int. J. Security and Networks, 8(2) (2013)
- Fu-Hau Hsu, "Data concealments with high privacy in new technology file system", The Journal of Supercomputing, 72(1), pp.120~140 (2016), Springer Nature[DOI]
- B. Carrier, "File System Forensic Analysis", pp.273~396 (2005), Addison-Wesley
- 조규상, "A Maximum Data Allocation Rule for an Anti-forensic Data Hiding Method in NTFS Index Record", The International Journal of Internet, Broadcasting and Communication, 9(3), pp.17~26 (2017), 한국인터넷방송통신학회[DOI]