The Experts below are selected from a list of 6 Experts worldwide ranked by ideXlab platform

Weippl Edgar - One of the best experts on this subject based on the ideXlab platform.

  • Quantifying Windows File Slack Size and Stability
    'Springer Science and Business Media LLC', 2013
    Co-Authors: Mulazzani Martin, Neuner Sebastian, Kieseberg Peter, Huber Markus, Schrittwieser Sebastian, Weippl Edgar
    Abstract:

    Part 4: FileSYSTEM FORENSICSInternational audienceSlack Space can be used to hide data from the operating system and other users. While some forms of data hiding are easily detectable, others are subtle and require an experienced forensic practitioner to discover the hidden data. The amount of data that can be hidden varies with the type of Slack Space and environmental parameters such as Filesystem block size and partition alignment. This paper evaluates the amount of File Slack Space available in Windows systems and the stability of Slack Space over time with respect to system updates. Measurements of the File Slack for eighteen versions of Microsoft Windows with the NTFS Filesystem reveal that many of the Files change very little during system updates and are, thus, highly suitable for hiding data. A model is presented for estimating the amount of data that can be hidden in the File Slack Space of Windows Filesystems of arbitrary size

Mulazzani Martin - One of the best experts on this subject based on the ideXlab platform.

  • Quantifying Windows File Slack Size and Stability
    'Springer Science and Business Media LLC', 2013
    Co-Authors: Mulazzani Martin, Neuner Sebastian, Kieseberg Peter, Huber Markus, Schrittwieser Sebastian, Weippl Edgar
    Abstract:

    Part 4: FileSYSTEM FORENSICSInternational audienceSlack Space can be used to hide data from the operating system and other users. While some forms of data hiding are easily detectable, others are subtle and require an experienced forensic practitioner to discover the hidden data. The amount of data that can be hidden varies with the type of Slack Space and environmental parameters such as Filesystem block size and partition alignment. This paper evaluates the amount of File Slack Space available in Windows systems and the stability of Slack Space over time with respect to system updates. Measurements of the File Slack for eighteen versions of Microsoft Windows with the NTFS Filesystem reveal that many of the Files change very little during system updates and are, thus, highly suitable for hiding data. A model is presented for estimating the amount of data that can be hidden in the File Slack Space of Windows Filesystems of arbitrary size

Sebastian Schrittwieser - One of the best experts on this subject based on the ideXlab platform.

  • Chapter 1 QUANTIFYING WINDOWS File Slack IN SIZE AND STABILITY
    2015
    Co-Authors: Martin Mulazzani, Sebastian Neuner, Peter Kieseberg, Markus Huber, Sebastian Schrittwieser
    Abstract:

    Abstract In digital forensics, different forms of Slack Space can be used to hide information from either the operating system or other users, or both. While some forms are easily detectable others are very subtle, and re-quire an experienced forensic investigator to discover the hidden infor-mation. The exact amount of information that can be hidden varies with the form of Slack Space used, as well as environmental parameters like File system block size or partition alignment. While some methods for Slack Space can be used to hide arbitrary amounts of information, File Slack has tighter constraints and was thought to be rather limited in Space. In this paper we evaluate how much File Slack Space modern oper-ating systems offer by default and how stable it is over time with spe-cial regards to system updates. In particular we measure the File Slack for 18 different versions of Microsoft Windows using NTFS. We show that many Files of the operating systems are rather static regarding sys-tem updates and do not change much on disk during updates, and are thus highly suitable for hiding information. We furthermore introduce a model for investigators to estimate the total amount of data that can be hidden in File Slack for File systems of arbitrary size

Neuner Sebastian - One of the best experts on this subject based on the ideXlab platform.

  • Quantifying Windows File Slack Size and Stability
    'Springer Science and Business Media LLC', 2013
    Co-Authors: Mulazzani Martin, Neuner Sebastian, Kieseberg Peter, Huber Markus, Schrittwieser Sebastian, Weippl Edgar
    Abstract:

    Part 4: FileSYSTEM FORENSICSInternational audienceSlack Space can be used to hide data from the operating system and other users. While some forms of data hiding are easily detectable, others are subtle and require an experienced forensic practitioner to discover the hidden data. The amount of data that can be hidden varies with the type of Slack Space and environmental parameters such as Filesystem block size and partition alignment. This paper evaluates the amount of File Slack Space available in Windows systems and the stability of Slack Space over time with respect to system updates. Measurements of the File Slack for eighteen versions of Microsoft Windows with the NTFS Filesystem reveal that many of the Files change very little during system updates and are, thus, highly suitable for hiding data. A model is presented for estimating the amount of data that can be hidden in the File Slack Space of Windows Filesystems of arbitrary size

Kieseberg Peter - One of the best experts on this subject based on the ideXlab platform.

  • Quantifying Windows File Slack Size and Stability
    'Springer Science and Business Media LLC', 2013
    Co-Authors: Mulazzani Martin, Neuner Sebastian, Kieseberg Peter, Huber Markus, Schrittwieser Sebastian, Weippl Edgar
    Abstract:

    Part 4: FileSYSTEM FORENSICSInternational audienceSlack Space can be used to hide data from the operating system and other users. While some forms of data hiding are easily detectable, others are subtle and require an experienced forensic practitioner to discover the hidden data. The amount of data that can be hidden varies with the type of Slack Space and environmental parameters such as Filesystem block size and partition alignment. This paper evaluates the amount of File Slack Space available in Windows systems and the stability of Slack Space over time with respect to system updates. Measurements of the File Slack for eighteen versions of Microsoft Windows with the NTFS Filesystem reveal that many of the Files change very little during system updates and are, thus, highly suitable for hiding data. A model is presented for estimating the amount of data that can be hidden in the File Slack Space of Windows Filesystems of arbitrary size