For digital forensic investigators, files that use Microsoft compound document file format (MCDFF) present a problem: It is easy to hide information in MCDFF but hard to detect hidden data in them. Using an application downloaded from the Internet and Win32 API (Application programming interface), it is possible for a criminal to hide information in MCDFF which might be important to an investigation. Prior to our research, no tool existed to detect data hidden in MCDFF, making analysis of MCDFF for investigations a difficult process. This paper presents an analysis of MCDFF features exploited in order to hide data and a tool ("DOCdetector") to detect hidden data using these exploits. Studying methods used to hide data in unused space and inserted streams led us to develop DOCdetector tool to aid in the detection and examination of hidden data.
[1]
Gary C. Kessler.
Steganography: Implications for the Prosecutor and Computer Forensics Examiner
,
2004
.
[2]
Gary C. Kessler,et al.
An Overview of Steganography for the Computer Forensics Examiner
,
2004
.
[3]
Brian D. Carrier,et al.
File System Forensic Analysis
,
2005
.
[4]
Claudio Soriente,et al.
Taking advantages of a disadvantage: Digital forensics and steganography using document metadata
,
2007,
J. Syst. Softw..
[5]
Ewa Huebner,et al.
Data hiding in the NTFS file system
,
2006,
Digit. Investig..
[6]
D. Artz,et al.
Digital steganography: hiding data within data
,
2001
.
[7]
CastiglioneA.,et al.
Taking advantages of a disadvantage
,
2007
.