Digital Forensics Explained

147

anti-forensiCs

operations, intercepts OS requests, translates them, and passes them to the

physical hardware. Hypervisor rootkits could modify the bootloader to create

malicious hypervisor similar to MBR infection or subvert the OS and migrate

it to a virtual machine while it is still running. e rootkit could gain control

of what the OS sees, which means that it could be extremely difficult to detect.

• Alternate data streams: is is rootkit utopia since ADS are not viewable

without special software by the human eye and there is no limit on the num-

ber or size of files, which can be stored in ADS.

• Slack space: Rootkits could hide in slack space, because it is one of the areas

many security tools cannot effectively scan.

• Interrupt hook ...