Time is on my side: Steganography in filesystem metadata. (7th August 2016)

• Record Type: Journal Article
• Authors: Neuner, Sebastian; Voyiatzis, Artemios G.; Schmiedecker, Martin; Brunthaler, Stefan; Katzenbeisser, Stefan; Weippl, Edgar R.
• Is Part Of: Digital investigation. Volume 18(2016)Supplement
• Page Start: S76
• Page End: S86
• Publication Date: 2016-08-07
• Subjects: Digital forensics -- Data hiding -- Steganography -- Storage forensics -- File system forensics -- Real-world data corpus; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2016.04.010
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: We propose and explore the applicability of file timestamps as a steganographic channel. We identify an information gap between storage and usage of timestamps in modern operating systems that use high-precision timers. Building on this, we describe a layered design of a steganographic system that offers stealthiness, robustness, and wide applicability. The proposed design is evaluated through theoretical, evidence-based, and experimental analysis for the case of NTFS using datasets comprising millions of files. We report a proof-of-concept implementation and confirm that the embedded information is indistinguishable from that of a normal filesystem use. Finally, we discuss the digital forensics analysis implications of this new information-hiding technique.