1. Data concealments with high privacy in new technology file system
- Author
-
Fu-Hau Hsu, Shiuh-Jeng Wang, Min-Hao Wu, and Syun-Cheng Ou
- Subjects
Computer science ,Flat file database ,Stub file ,02 engineering and technology ,Class implementation file ,computer.software_genre ,Theoretical Computer Science ,Data recovery ,Design rule for Camera File system ,020204 information systems ,Data file ,Data_FILES ,0202 electrical engineering, electronic engineering, information engineering ,Versioning file system ,SSH File Transfer Protocol ,File system fragmentation ,File system ,Indexed file ,Database ,business.industry ,Computer file ,Device file ,020207 software engineering ,computer.file_format ,Unix file types ,Torrent file ,File Control Block ,Self-certifying File System ,Hardware and Architecture ,Journaling file system ,ZAP File ,Operating system ,Fork (file system) ,Image file formats ,business ,computer ,Software ,Information Systems - Abstract
This paper proposes a new approach, called file concealer (FC), to conceal files in a computer system. FC modifies metadata about a file in NTFS (New Technology File System) to hide the file. Unlike traditional hooking methods which can be easily detected by antivirus software, experimental results show that it is difficult for antivirus software to detect the files hidden by FC. Moreover, to enhance the concealment capability of FC, FC also rearranges the order of some data sectors of a hidden file. As a result, even if another person finds the original sectors used by the hidden file, it is difficult for him to recover the original content of the hidden file. Experimental results show that even data recovery tools cannot restore the content of a hidden file. All information that is required to restore a hidden file is stored in a file, called recovery file hereafter. When a user uses FC to hide a file, the user can specify any file as a host file, such as an image file, to which the recovery file will be appended. As a result, the user can easily restore a hidden file; however, it is difficult for other person to detect or restore the hidden file and the related recovery file.
- Published
- 2015
- Full Text
- View/download PDF