Anti-Forensics I just finished reading an interesting article on Mark Whitteker ISSA Journal, that summarizes some basic techniques of anti-forensics, I find this kind articles very constructive, why do not they say anything new, but serve to bring together and synthesize the concepts, which is useful, particularly in an area so rich in techniques to remember. What is anti-forensics? It's all those escamotages, serving to embarrass the "digital
investigators" in order to be able to hide or make it very awkward retrieval of digital evidence.
types of anti-forensics can be divided into three main branches:
Data Hiding (hiding data) Tool's weakness (known weaknesses of the tools for computer forensics) Investigator's weakness (weakness investigator)
hiding data
Data can be hidden in many ways, not only on the hard disk in question, but also on Web sites of storage,
here you can find a discussion of Mario Pascucci on some techniques, but let us consider the most common and well known: Encryption Encrypt
entire volumes or only file, may be the most easy to implement, but it becomes one of the toughest obstacles for the digital investigator because an encryption with AES (Advanced Encryption Standard) 128 bit 128 has 2 possible keys with a brute force attack does not come to anything, except in a very long time (we're talking years) constant and parallel processing.
So in this case, the investigator agrees that, look for the password in other ways, such as check in system memory (ram dumping) any password entered, if there is some readable file, having a log of a Any pre-installed key-logger or a profiling of the suspect, but attempts are really tied to hope and luck, for example, if the password is a possible word, maybe just a dictionary attack and the chest opens ;.
Steganography
From ancient Greek "hidden writing", is a known technique for hiding information in other binary files, including pictures, mp3 files, etc..
Personally, I developed a small instruments for teaching purposes, which may be understood as a trivial steganography:
BrutalStego
or a more complex with
NBSTEGO . There are many tools for steganography as: JHide,
Digital Invisible Ink and many more that you can read here
.
systems to see if a file contains steganography are based on probabilistic algorithms, in fact often give false positives and false negatives, none of this can be useful to the investigator, unless they have found traces of steganography programs on the PC of the suspect, otherwise it becomes a hunting blind.
-
- Unallocated space and secure deletion
-
This is the space not occupied by active files, because when a file is deleted from the system, the fact remains physically in a space marked as "unallocated" therefore available to write another file.
Clearing standard serves only to eliminate the pointer to the file from the File Allocation Table (FAT) or Master File Table (MFT).
With computer forensics tools, you can recover deleted files (advertising occult
FUNDL or SFDUMPER
), but if you fill up before deleting files or careatteri random zeros at the end you can not recover more than the original file.
SLACK SPACE
The files are saved when they are allocated in clusters, groups of sectors on the disk, but if a file occupies clusters 5 and a half is allocated into six clusters, leaving half free cluster. There are tools like Metasploit's Slacker
utility that allow you to write in the slack space, that space that is advancing in a cluster, then if you encrypt the file and insert it in the slack space, the investigator may be drawn with deception, finding only the data that seem to trash previous file allocated in that cluster, when it is an encrypted file.
TOOL'S Weakness Other anti-forensics techniques, can exploit bugs or reside in the known weaknesses of the most popular tools for computer forensics. The
ADS (Alternate Data Streams)
, no longer a threat. The
MD5 collision, ie you can edit a file and to be the same MD5 hash of the original file, this can serve to hide a file and claim it as a file known, when the investigator performs a search using matching the MD5 hash of a dictionary of known about the files contained on the disk in question.
Changing the Timestamp
with this technique you can trick the tools that create a timeline based on the time of MAC (Modify, and Create Access file).
The manipulation of the magic number and file extension , this technique is quite disturbing to the investigators, because if you change only the extension of a file, for example, from JPG to DOC programs carving ( Foremost, Photorec, Scalpel, etc.). and programs such as "file" or "TridNet, realize it, because we consider the headers and footers file (in the case of JPG and FFD9 FFD8 are in hex), but if you also change the headers and footers, you cheat, even this tool, so it made a thorough inspection and manual!
LA investigator's Weakness
This is, in my opinion, the technique more problematic, it is condensed into a simple concept, ie the time and resources that must employ an investigator to analyze the media seized. Just have several gigabytes or terabytes of disks, Raid, use techniques for hiding data and then tests to be conducted via lead many resources in terms of time and money, forcing the investigator to work at large. This is a reflection that I had asked many times when I read all the techniques "for" anti-forensics, I often wondered:
"But if a technical consultant to analyze receives 10-100 250GB hard drive one, how can get up to work on every hard disk, checking for encryption, steganography, slack space, hidden files in the spaces between MBR and partition start, hidden partitions, file systems inside the file system, etc.. etc..? "
Conclusions
I think it's useful to know more about possible methods of hiding data, but always believe in the motto "it is easier to conceal than discovering"
Nanni Bassetti
echo "Insert the file where to hide:" 
SMART Linux 