Researchers use disk frag to hide data

Data is hidden in plain site as fragmented pieces

Researchers released a paper detailing how to hide data from prying legal eyes by exploiting disk fragmentation on a clustered file system, thereby hiding it in plain site.

The researchers at the University of Southern California at Los Angeles and the National University of Science and Technology (NUST) in Islamabad, Pakistan, stated that encryption is ineffective in a forensic investigation.

That is "mainly because the presence of encrypted data on a disk can be easily detected and disk owners can subsequently be forced (by law or other means) to release decryption keys," the researchers wrote in a summary of their paper.

The paper, "Designing a cluster-based covert channel to evade disk investigation and forensics," details how information can be hidden in the arrangement of the clusters of a file, which causes deliberate fragmentation, "a phenomenon that is not unusual to find on heavily-used file systems."

In order to evade forensic investigation, the researchers propose storing sensitive information on a covert channel as 24-bit fragments on half-empty drives on a clustered file system, allowing plausible deniability of the existence of the data by a user.

The data-hiding algorithm is created using FAT32-formatted disk drives and exploiting the way operating systems group consecutive sectors on a disk. Those sectors create the clusters that store the content.

"This approach works well until there are no consecutive unallocated clusters available. In that case, the contents of the file are scattered or fragmented across the file system," the research paper states.

The researchers also presented statistics about the incidence of file fragmentation on actual file systems from 52 disk drives belonging to a diverse set of users. Based on the statistics, they presented guidelines for selecting good cover files.

"Finally, we show that even if an investigator gets suspicious, he/she will incur an unreasonably high O(m2) complexity to reveal an m bit hidden message," they wrote.

Lucas Mearian covers storage, disaster recovery and business continuity, financial services infrastructure and health care IT for Computerworld. Follow Lucas on Twitter at @lucasmearian or subscribe to Lucas's RSS feed. His e-mail address is lmearian@computerworld.com.

Read more about storage in Computerworld's Storage Topic Center.

Join the newsletter!

Or
Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityinternetdata securitystoragedata protectione-commercestorage softwaree-businessStorage ManagementUniversity of Southern California

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucas Mearian

Computerworld (US)
Show Comments

Essentials

James Cook University - Master of Data Science Online Course

Learn more >

Mobile

Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >

Exec

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?