Send Byline Calculated with airSlate SignNow

Add byline data

you this is the second part of data hi it is intended for use in the course CGS 5131 at the University of Central Florida my name is Rick line occur so we're going to talk about disk slack space now and in general this is unallocated disk space this is normally referred to as slack space but we need a little bit of clarification because there are really two different types of slack space there's disk slack and file slack we're going to first take a look at dis lack and then eventually we'll get the file slag the tool we're going to use for our exploration of dis slack is going to be Winx winhex automatically shows you all unallocated space in a section or a group so this is really convenient um you can actually hide all your data into this unused surround allocated space and you'd have to use a tool such as Windex or some other disk editor or maybe ftk or something like that to find it the only problem with this is the data hidden in dis lack is susceptible to be an over in for instance I could hide a bunch of information and then someone might actually override all that by saving files to that disk I've got a flash drive plugged into my computer and you can see it has several files five files one sub directory and within the subdirectory it's got a single file but this is actually not very much data mostly the USB stick is is largely empty which means there's a lot of unallocated space so if there was a large if there was a lot of unallocated space then there'd be a lot of room to hide data okay we're going to come back to here after we've hidden some data there okay winhex let me go ahead and open up that disk okay so the typical Winx display I've got my boot sector we've got both fats okay and as you can see you know initially early on in the fats because there are several files you have entries but it's not long before you get 20 a tad injuries these are all 0 it out so there's you can see I've got a lot of room left of that at fat section so as you can see there's a lot of space according to the fats I'm available care the files you take a look at the binary representation here's the root directory and there aren't many files listed in the root directory okay but what we're interested in is the free space notice here that in the free space that said said seven point six gigs it's almost the entire disk is this free space here it's all 0 it out okay so in the free space I could actually I could use any of this so let's go ahead and go in here into the ASCII editor and i'm going to say my rip okay then I'm going to go to the end of the free space and do the same thing ok so now I've got it twice let me going to save this just to make sure there's nothing on my sleeve I'm gonna go ahead and close everything else rerun Winx but first let's go ahead and refresh our directory here we can't tell that anything was ready to that disk looking at a file directory okay let's rerun Winx ok open up the disk taking the snap shots because we we did right to the disk so now let's go ahead and search for it line occur Hayley's see what it finds and this will probably take about six or seven minutes from my previous test that's about what what it took so I'm going to snip part of this out of the video so you don't have to sit here and watch them green bar moving ok so here you can see that it found line occur two times which is really what we would have expected so let's go ahead and get rid of Linux right now ok so now i'm going to directory where I have some test files one of them is an audio file it's really big let's go in copy audio mp3 to J and that's a that's a 40 Meg file approximately 41 actually ok it's out there and if we go to our display folder you see audio down tap it back audio to mp3 ok this is rerun windex open that disc ok the reason we taking a snapshot is because we changed the disc by copying the audio file out there ok so now let's go ahead and look for light after it will search the disc for line occur and here again just going to take about six or seven minutes all sniff out part of this and video okay so it was only found one time which makes sense because we copied a very large audio file onto the disk and what that means is we wrote we overwrote the very first part of the free space so if we click here where it found it we can see that is actually at the very end of the free space now if from back here we go to free space you notice the first part of the free space doesn't say my name is Rick clinic or like it did before that's because we took the free space we wrote the audio file and now the free spaces is all zeros as it was before so it's actually no for Team eggs into the free space whoo so now it's 40 Meg's into what was the free space so that's fat let's go ahead and open that up okay so here i am in win hex and let's go ahead and open up an NTFS disk drive oh and TF demo okay so essentially you see something similar except for remember we've got all this these metafiles okay so I'm going to go into so I'm going to go into free space which is 7.5 gigs and the same thing is true here my name is rip planetoid and as we saw if you really want to be a lot safer you go to the end and maybe type it there somewhere they're mine so that's that's about it for a kind of spell my own name that's really bad okay so if I saved it would get written to this I'm not gonna save this so i can save this example and keep that keep the USB stick clean now in just a minute we're going to take a look at a program that can help you to do right to an int to interest and then we're going to take a look at a program that will allow you to write to a fat32 USB stick okay so i'm going to take my i'm going to take my ubiquitous complete fat analyzer program rework it just a bit so we can write data into the unused space so here I'm getting the fat list now what I do is I make sure I know where the receptor is create a little message buffer here koppiyam my name is Sam Smith now I set the file pointer there's nothing magic about 25,000 I use the calculator to figure out what would get me well past all the data including that big audio data file and then I just call right file so let's go ahead and set a breakpoint here and what's going on that to get there okay I'm gonna have to move this to you over just a bit okay so there's my message queue saying the file pointer I'm writing the file close the file okay okay and we'll go ahead open that disk will go in search for Sam Smith here again this will take a while okay so here we have the results my name is Sam Smith written actually quite quite a ways into the free space so this is an example of how you can actually write your own program that that writes into the free space and I would actually be interested in having one or more of you develop an actual program with a front-end that does is that would be actually really nice let me know if you're interested and I can wave one of your assignments or i can give you extra credit your choice now let's talk about file slack i know we spent a few minutes talking about disc slack fios slack in my mind is a bit more useful than dis slack the reason for this is a couple so when i write a big audio file to the disc it will never overwrite files lack the second thing is if you're really careful about file slack it's very hard to detect and right now we're only going to be doing the basic file slack but our next presentation in part three of this where we're going to be talking about steganography and then how to apply steganography to file slack so I think files lack is a much more useful approach to hiding data so let's talk about it so when you save a file send notepad or anything else the data is passed off to the file system for the target storage device and most of the time that's going to be a hard drive or a USB stick or something like that so all storage media whether it's a hard drive or SSD flash drive CDs DVDs they're broken up into sectors and I know we've already talked about this a number of times sector usually contains 512 bytes as we've said not always but usually and that's just about the right size for the first paragraph of the Declaration of Independence reason I bring this up is because we're going to be using the Declaration of Independence actually for example but since modern storage devices have huge numbers of sectors we need to somehow simplify their their management of these sectors so they group the sector's into larger units called clusters which as we've already specified that most of the time a cluster has eight sectors now that the sky eight sectors are always contiguous are always one after the other you can have clusters all over the hard drive but within a cluster you always have eight contiguous sectors this gives a total of 4096 bytes now here again remember that some formatting options can change the sector size and the number of sectors in a cluster but 99.999% of time it's going to be eight sectors in a cluster 512 bytes in a sector for a total of 4096 bytes in a cluster so this is this is a cluster layout I've got a single sector shown here 512 bytes and just as an illustrative I've got when in the course of human events so you know that that that can fit the first paragraph of the Declaration of Independence so we've got it we've got a cluster here pictured cluster has eight sectors for a total 4096 fights note that the sector have to be contiguous but this leads to what could be a lot of wasted space an interesting byproduct of this organization of sectors and clusters and bytes is that most files which are written to disk have leftover space after the actual file data that's because all files are going to be written file size is always written to disk in multiples of 4096 now just to let you know that is that is a partial um as a partial in accuracy on ntfs has has what are called resident files and I'm not going to cover those right now very small files in NTFS actually have no clusters their actual data can be stored in mft but I'm sort of glossing over that right now and talking about files that are say greater than or equal to about 1k I did a lot of experimentation in I did a lot of experimentation several years ago and I think for my experiments it was 268 bytes for Less would being stored as a resident file but let's say you want to you want to save a file with 1024 bytes of data that's only two sectors 512 bytes per sector times two is 1024 so now you've got this entire cluster allocated on disk but you've only actually written two sectors so now you've got a ton of leftover space at the end so since the smallest unit of space the file system uses as a cluster it will always write a minimum of eight sectors or 4096 bytes of course unless it's a resident file which we've already talked about so your 1024 bite file actually occupies 4096 bytes on the disk the unused space is 3072 bites lots of space for black hats or even enterprising white hats to hide stuff ignoring the amount of space that the cluster occupies the file size that the operating system report is only that of the actual file table which in this case is 1024 nobody will notice that there's data written into a slack space okay so here's how this wasted space layout happens the red is the actual file data the blue is the unused disk space past the actual file data so here we've got a single cluster once again and the first two sectors are occupied with file data after that you've got 3072 bytes which are unused and completely ready to have data hidden in them from a developer's point of view slack space is normally inaccessible I know if you do any kind of c programming you have f open fwrite every F close and so forth none of those say right to the slack space it's just not part of the normal API so in order to read from and write to slack space you must actually rely on some some pick up some more obscure and poorly documented system ap is I'm not really sure if they're poorly documented as such but there just aren't that many references online or in books so it's just harder to find for this reason slacks base is off-limits to majority of programmers um in addition you know your program needs to operate in administrative mode to a lot of people forget this so now enter the black cat who wants a safe place in which to hide data let's say for instance that he wants to hide a list of credit card numbers or a list of passwords or a list of really anything he can write special software to access the slack space where I rely on the system ap is so like I said it's not impossible it can be done in fact it's done all the time then you can write the list of credit card numbers in the slack space of a seemingly normal file of course this takes some effort and a fairly capable programmer that can be done is and it's done on a regular basis okay detection well this is difficult it is rarely done so almost never will anybody detect um data that was written in the slack space and we're actually going to follow up on this in part three of this this series and talk about ways to really make it hard to detect the only the only tools that you may may be able to use to extract select data are like forensics tools such as ftk you can actually use windex to to do it and examiner's must implicitly instruct their software to address the slack space since the default settings don't usually add slack space to their list of investigative techniques so how do you write to the file slack methodical white hat point of view we're thorough examination of digital systems is used to reveal evidence there's a great value in taking the black hat point of view from the black hat perspective my students get a more comprehensive understanding of the science of digital forensics I have a slack utility that I have been developing over the years some students have helped me and I actually welcome your help if you're interested please let me know and we're actually going to take a look at that utility in just a couple of minutes okay so here is a visual c++ program and that i wrote Visual Studio 2013 and it's an mfc um dialogue application mfc stands for microsoft foundation classes so it's a dialogue based application just kind of keep it small and simple so let's go ahead run it it does have a GUI and which is good because then we can go ahead and select these files without having to a really ugly command line printer my name is Arnold Palmer and that's in reference to him he just died so we're trying to honor him click here store the message so now let's go ahead and step through this this mounted drive just as we do a two up or so it's really easier and we have these two statics up here I'm in keeping these just sending these just makes a lot easier that doing a couple of sprint apps okay so the reason we need to get the file system format is because ntfs and fat32 are different ntfs the clusters that are reported with a cluster map that's reporting is direct you can count on that and do a sikh on the disk however in fat32 they're actually logical so you actually have to add an offset um into the data let's see we have here we have fat32 ok so that's going to be a big clue ok so let's keep going now you've seen this before get dis free space so we get sectors per cluster and bytes per sector very important just in case this particular device is not standard can we create the file for reading we're going to give the file size and here we're just making some pretty simple calculations we want to get that the number of plus the Vice per cluster the number of clusters and the number of sectors this is going to help us actually this will help us find the place on the disk where the with your file resides ok this next part is we need to find the file extends ok then within each file extent than is one or more clusters so we make this windows api out here again this is what i was referring to um finding documentation on this is is relatively difficult so so that's why I earlier in this presentation I mentioned that it's poorly documented it's not really poorly document it's just hard to find so I go ahead and get this close the handle because I'm done with that just want to make sure everything passed ok now what I do is I create a buffer for my cluster for my cluster map and I walk through the extents in here there's only going to be one okay remember an extent is anywhere from 1 to 1.5 million clusters ok I get the number of clusters in this particular extent remember I can have more than one extent ok i loop through and i put the cluster number into that buffer now this is a really small file the file actually is is less than a single cluster so that's why that's why i just got a single cluster and single extent now here's something that took me a long time to figure out that you really need to go ahead and offset if you're if you're using fat so you're on making a check to see if my file format as fat it is so now i actually have to go in and read the boot sector you've already talked about the boot sector bit and the bios grammar blocked in the extended bios parameter blocker of special interest to us here okay so here's we're going to get the reserve sector count from the bios parameter blog to use and we're going to use the logical sectors per fat and that way we know what to skip the reason we're going to skip all the reserved we're going to skip the two fats okay so reserved plus the fats so this let's calculate what to skip so we seek and for red ever reason I have some old legacy code here when I'm reading some directory entries you can actually ignore this I need to take this out like I said this is a program under development and so these two lines here have no place in what I'm doing at this moment close the handle ok so now I can go ahead and do my calculations so I know where to offset ok now I go through the so now I go through the cluster map then I had clusters add to extend that's 4096 ok now I'm going to open the drive for writing so I open the dr valid handle their the handle isn't value if the handle isn't valid will drop out now I have to use a large integer I have to use large integers because these values get very large very fast it will surpass the ability of the D word to contain them ok so here's the cluster number notice this puts me in the very last cluster in this list it might be since it's one is going to equate to 0 but it might be a hundred or something okay go ahead and calculate my number of bytes per cluster and finally seek to equals the cluster number times bytes per cluster okay so now we're going to add however many sectors the file actually took so file actually took four sectors and so since we have this whole cluster we need to seek four sectors in in order to make sure we avoid the data that's already there or will be hosing up our regular data add we seek to where we're going message buffer my name is Arnold Palmer message length for we write the data if those filing a we are done and rui comes back up we're good to go ok let me go and bail out of that minimize this let's get our old friend winhex open disk snapshot and we should actually Arnold to search for all and when it shows that it's found 1 and stopped the search ok so it shows one hit that's I happen to know since I know this disk that's all some again upward this search on almost found one time here we go and notice if we scroll up we see the the end of sector sector that's sector 4 of the Declaration of Independence so there we wrote that to disk we wrote that the slack file and i can write large files this USB stick all day long and it won't overwrite this lex this backspace here again as with that thing we did in part 1 i'm looking for help so that i can turn this into a peer-reviewed academic article well slack space isn't incredibly new the approach I'm taking with this and the approach i'm going to be taking in part 3 are actually fairly unique so this is what i need help with the following code testing and cleanup and commenting need to look for also other similar existing techniques and i know they're out there for instance i know metasploit has something called slacker and it's largely targeted towards a linux base I need someone to make the usual charts and graphs to kind of break up the text so the article is more appealing more interesting need someone to kind of research the journal part that to do help with the submission part of it obviously we need technical and grammar editing and maybe other things that I haven't thought of so if you're interested send me an email to my ucf address if you're interested also send me what times you're available to maybe meet or get together or do a Skype or Google hangout or something and your name will get added to the article by line if you help