12. Hidden data

17. Analysis

Cross-platform data hiding

In short: whatever the platform, hidden data shows up as a discrepancy; this method is operating-system independent, and the platform sections give the locations where each check applies.

Look for five kinds of discrepancy

• Filesystem metadata against file content: name, extension and recorded type against the actual bytes.
• Storage allocation against accounted space: partitions and volumes against the device size; allocated blocks against files; file sizes against extents.
• User activity against files present: a recent-items entry, a link file or a log line referring to a file that does not exist, or a mounted volume that is not on any disk.
• Timestamps against each other: filesystem times against internal metadata (EXIF, document properties), against journal entries, and against the ordering constraints the filesystem imposes.
• Expected behaviour against observed: a tool installed that has no legitimate purpose on that machine, a directory with unusual permissions, a service listening where none should.

Check file signatures

Compare each file's extension, and the type the filesystem or application records, with the magic value at the start of the file and its internal structure. That is how you find a JPEG named as a spreadsheet, a ZIP archive with an image extension, or a VeraCrypt container named as a video.

• Whole image: forensic suites and Autopsy report extension mismatches.
• Single files: the file command.
• Doubtful cases: a hex viewer settles them.

Measure entropy

Shannon entropy measures how evenly byte values are distributed. Encrypted, compressed and packed data all score near the maximum; text, most documents and executable code score lower and unevenly. Measure it over a sliding window across an image, or file by file.

Tools: binwalk -E, the ent utility, the entropy views in forensic suites, and short scripts.

Examine deleted and residual data

Work through unallocated space, slack space, deleted directory entries and inodes, orphaned metadata records, filesystem journals and change logs, and residual structures from earlier filesystems or partition layouts, as set out in section 18.

• Windows: the change journal and shadow copies.
• Linux: the ext4 journal and orphan list.
• macOS: snapshots and FSEvents.

The sources differ, but the question is the same: what existed that the current directory tree no longer shows?

Find hidden storage

• Hidden partitions and unallocated gaps. Parse the partition table and account for every sector; mmls from The Sleuth Kit lists the unallocated ranges between and after partitions. Examine directly: a gap large enough to hold a filesystem, a partition whose type does not match its content, or a deleted table entry whose filesystem boot sector survives.
• Encrypted containers. Large files of uniform high entropy with no signature, especially with round sizes or names suggesting media.
• Loopback filesystems and virtual disks. Disk image files (raw, dmg, vhd, vhdx, vmdk, qcow2, vdi) are filesystems inside files. Find them by signature and by size, mount copies read-only, and examine them through the full process, including their own encryption and their own nested images.
• Nested filesystems and unusual layouts. A filesystem inside a file inside a volume inside an encrypted partition (section 14) is examined layer by layer. Unusual layouts, such as a second bootable partition, an oversized recovery partition or a filesystem starting at an unexpected offset, are listed and explained, or reported as unexplained.

Check metadata-based hiding

• NTFS alternate data streams attach additional named data to a file or directory, invisible to normal directory listings, holding any content. List them live with dir /r and Get-Item -Stream *; forensic tools list them as separate entries against the parent file. The Zone.Identifier stream is legitimate and records download provenance; examine the others.
• Extended attributes on Linux and macOS, and resource forks on macOS, likewise hold arbitrary data invisible to a plain listing (sections 14 and 15).
• ACLs, unusual permissions and hidden attributes. List and examine: files readable by nobody, directories with the hidden and system attributes set on Windows, immutable flags on Linux, the hidden flag and the Finder "invisible" attribute on macOS, and permissions that differ from every neighbour.
• Filesystem-specific metadata can be abused. NTFS timestamps in the standard information attribute can be set by software, while those in the file name attribute normally cannot, so disagreement between them indicates manipulation. Reparse points and junctions redirect paths. Sparse and compressed attributes change how size relates to allocation. Each platform section lists its own.

Carve when metadata is gone

Where filesystem metadata is damaged, missing or deliberately removed, carving recovers files by signature and structure from raw data: unallocated space, slack, a whole image, or a decrypted container. PhotoRec, Scalpel, Foremost, bulk_extractor and the carving modules of forensic suites do this at scale (section 19).

Know its limits:

• No names, paths or timestamps come back with the content.
• Many false and partial results.
• Usually assumes each file is contiguous, which deliberately fragmented files and most large files on a busy volume are not.

Test for steganography on indicators

Steganography hides data inside a carrier:

• Images and audio: the least significant bits of pixels or samples.
• Video: unused fields and frames.
• Documents: formatting, revision history or embedded objects.
• Archives: comment fields, padding or appended data.

Detection is driven by indicators, not applied blindly to every file. Indicators include:

• Steganography software or its traces: installed programs, recent files, command history, browser downloads.
• Near-duplicate carriers that differ from others in size or in their low-order bits.
• Oversized images: larger than their dimensions and format warrant.
• Data appended after the format's end marker.
• Archives whose stored sizes do not add up.

Given an indicator, examine the specific carriers:

• Statistical tests for LSB embedding.
• Comparison against the original, where one exists.
• Structural parsing to find appended or embedded data: binwalk finds embedded files by signature; strings exposes embedded text; ExifTool exposes metadata fields, including unusual or oversized ones.
• Extraction with the identified tool, where the tool is known.

Rebuild deliberately fragmented files

1. Inspect the filesystem's allocation metadata for a surviving record, and reconstruct the extent or cluster chain from it where possible.
2. Where the record is gone, correlate candidate fragments by file structure, headers and footers, internal markers, embedded metadata, sequence information (restart markers, chunk indices, packet numbers) and content similarity across the join.
3. Reconstruct manually where automated recovery fails.
4. Retain the reconstruction process and the provenance of every fragment.

Section 19 gives the full method and section 20 the validation.

Pick the right tool

No single tool is authoritative. Where a finding matters, confirm it with a second tool or by direct inspection of the bytes.