Chapter 5. Data Hiding

One of the most challenging aspects of a forensic analysis of a computer is the possibility of data being intentionally hidden by your suspect. Always assume that a system you are examining might contain hidden data. Even if it was not intentionally hidden to defeat analysis, data hidden by the operating system exists on all systems. With practice and the techniques we will share with you, many of your encounters with hidden data can be rewarding experiences.

As shown on Table 5-1, there are a number of different ways to hide data on a computer. We discussed encryption in the previous chapter, but it should be clear from Table 5-1 that encryption is not the only way to obscure information. Many of these techniques have ...

Get Computer Forensics: Incident Response Essentials now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.