Skip to main content
SpringerLink
Log in
Book cover

New Results in Dependability and Computer Systems pp 237–244Cite as

Methods for Detecting and Analyzing Hidden FAT32 Volumes Created with the Use of Cryptographic Tools

  • Conference paper

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 224))

Abstract

The article describes the theoretical and practical methods for detecting and analyzing hidden volumes created with the use of cryptographic tools. The presented method is based on an analysis of the differences that result from the use of a hidden volume in FAT32 file systems. The method is effective both when the password is known to the host container and in the situations when password is not known. Potential computer forensic application of this methodology varies from standard investigations to advanced analysis of network and in the cloud data storages.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   169.00
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Kornblum, J.D.: Implementing BitLocker Drive Encryption for forensic analysis. Digital Investigation 5(3-4), 75–84 (2009) ISSN 1742-2876

    Article  Google Scholar 

  2. Casey, E.: Practical Approaches to Recovering Encrypted Digital Evidence. International Journal of Digital Evidence 1(3) (Fall 2002)

    Google Scholar 

  3. Altheide, C., Merloni, C., Zanero, S.: A methodology for the repeatable forensic analysis of encrypted drives. In: Proceedings of the 1st European Workshop on System Security, EUROSEC 2008 (2008)

    Google Scholar 

  4. Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J., Felten, E.W.: Lest we remember: Cold boot attacks on encryption keys (February 2008) (submitted for publication)

    Google Scholar 

  5. Liskov, M., Rivest, R., Wagner, D.: Tweakable Block Ciphers. MIT and UC Berkeley (2002)

    Google Scholar 

  6. Security in Storage Working Group of the IEEE Computer Society Committee. IEEE P1619, Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices (2007)

    Google Scholar 

  7. National Institute of Standards and Technology (NIST). NIST Special Publication 800-38E, Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices (January 2010)

    Google Scholar 

  8. Information Technology Laboratory, NIST. FIPS Pub 140-2: Security Requirements For Cryptographic Modules

    Google Scholar 

  9. Kleidermacher, D.: Enhance system security with better data-at-rest encryption. Embeded (March 2012)

    Google Scholar 

  10. Menezes, A.J., van Oorschot, P.C., Vanstone, S.A.: Handbook of Applied Cryptography. CRC Press (1996) ISBN 0-8493-8523-7

    Google Scholar 

  11. Czeskis, A., St. Hilaire, D.J., Koscher, K., Gribble, S.D., Kohno, T., Schneier, B.: Defeating Encrypted and Deniable File Systems: TrueCrypt v5.1a and the Case of the Tattling OS and Applications. In: 3rd Workshop on Hot Topics in Security (2008)

    Google Scholar 

  12. Canetti, R., Dwork, C., Naor, M., Ostrovsky, R.: Deniable Encryption, Cryptology ePrint Archive, Report 1996/002

    Google Scholar 

  13. Anderson, R., Needham, R., Shamir, A.: The steganographic file system. In: Aucsmith, D. (ed.) IH 1998. LNCS, vol. 1525, pp. 73–82. Springer, Heidelberg (1998)

    Chapter  Google Scholar 

  14. Jozwiak, I., Kedziora, M., Melinska, A.: Theoretical and practical aspects of encrypted containers detection - digital forensics approach. In: Zamojski, W., Kacprzyk, J., Mazurkiewicz, J., Sugier, J., Walkowiak, T. (eds.) Dependable Computer Systems. AISC, vol. 97, pp. 75–85. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  15. Walker, J.: Introduction to Probability and Statistics, A Pseudorandom Number Sequence Test Program. Fourmilab (January 28, 2008)

    Google Scholar 

  16. Fragkos, G., Tryfonas, T.: A cognitive Model for the Forensic Recovery of End User Passwords. Digital Forensics and Incident Analysis, 48–54 (2007)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Wroclaw University of Technology, Wyspiańskiego 27, 50-370, Wrocław, Poland

    Ireneusz Jóźwiak, Michał Kędziora & Aleksandra Melińska

Authors
  1. Ireneusz Jóźwiak
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Michał Kędziora
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Aleksandra Melińska
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ireneusz Jóźwiak .

Editor information

Editors and Affiliations

  1. , Institute of Computer Engineering, Wrocław University of Technology, ul. Janiszewskiego 11/17, Wrocław, 50-372, Poland

    Wojciech Zamojski

  2. , Institute of Computer Engineering, Wrocław University of Technology, ul. Janiszewskiego 11/17, Wrocław, 50-372, Poland

    Jacek Mazurkiewicz

  3. , Institute of Computer Engineering, Wrocław University of Technology, ul. Janiszewskiego 11/17, Wrocław, 50-372, Poland

    Jarosław Sugier

  4. , Institute of Computer Engineering, Wrocław University of Technology, ul. Janiszewskiego 11/17, Wrocław, 50-372, Poland

    Tomasz Walkowiak

  5. , Systems Research Institute, Polish Academy of Sciences, ul. Newelska 6, Warszawa, 01-447, Poland

    Janusz Kacprzyk

Rights and permissions

Reprints and permissions

Copyright information

© 2013 Springer International Publishing Switzerland

About this paper

Cite this paper

Jóźwiak, I., Kędziora, M., Melińska, A. (2013). Methods for Detecting and Analyzing Hidden FAT32 Volumes Created with the Use of Cryptographic Tools. In: Zamojski, W., Mazurkiewicz, J., Sugier, J., Walkowiak, T., Kacprzyk, J. (eds) New Results in Dependability and Computer Systems. Advances in Intelligent Systems and Computing, vol 224. Springer, Heidelberg. https://doi.org/10.1007/978-3-319-00945-2_21

Download citation

Publish with us

Policies and ethics

Search

Navigation