NULL Byte Injection: Anti-Forensic Technique for Data Hiding in FAT32 File System
- Authors
- Kim, D.; Lee, Y.K.; Jeong, J.
- Issue Date
- 3-Oct-2022
- Publisher
- Association for Computing Machinery
- Keywords
- anti-forensics; data hiding; digital forensics; directory entry; FAT32; file system
- Citation
- Proceedings of the International Symposium on Mobile Ad Hoc Networking and Computing (MobiHoc), pp 265 - 270
- Pages
- 6
- Journal Title
- Proceedings of the International Symposium on Mobile Ad Hoc Networking and Computing (MobiHoc)
- Start Page
- 265
- End Page
- 270
- URI
- https://scholarworks.bwise.kr/hongik/handle/2020.sw.hongik/32054
- DOI
- 10.1145/3492866.3558587
- ISSN
- 0000-0000
- Abstract
- In the FAT32 file system, a null byte in the metadata means that there is no file or folder. Since the metadata are stored consecutively, if the first byte of a metadata field is null, the operating system does not read data anymore. In this study, we propose an anti-forensic technique referred to as NULL Byte injection, which hides files or folders by injecting null bytes into the metadata field of the FAT32 file system. We presented 3 injection methods for hiding, and we evaluated the effectiveness and limitations of each injection method through experiments. As a result, we confirmed that our technique can hide files or folders in Windows OS. Based on the injection method, different effects were observed. We also confirmed that our methods can hide files or folders and bypass the detection of several forensic tools. Our technique can contribute to preventing such anti-forensic attacks by exploiting the mechanism of the file system to hide data. © 2022 ACM.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - College of Engineering > Computer Engineering > Journal Articles
![qrcode](https://api.qrserver.com/v1/create-qr-code/?size=55x55&data=https://scholarworks.bwise.kr/hongik/handle/2020.sw.hongik/32054)
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.