Hi, i'm conducting an investigation and have come across a notepad file that appeared at first to contain no data, however when i press ctrl+a a blank area is highlighted, roughly about a sentence long. At first i thought that maybe copying the highlighted area into Word and then changing the colour would do the trick and let me see the data but it doesnt. And when the highlighted area is pasted into a word document the word count is 0. But i have a strong feeling there is something there.
Does anyone have any idea how i can see this data? how this text (as i suspect it is) might have been hidden?
I have little time
Thanks fro any info guys
Look at the file with a hex editor
i've opened it in WinHex but its contents just show as all 0's. How could this have been hidden? ?
forenz are You using notepad program on suspect computer?
Hi, i'm conducting an investigation and have come across a notepad file that appeared at first to contain no data, however when i press ctrl+a a blank area is highlighted, roughly about a sentence long.
And 'a notepad file' being exactly what?
I assume it's a file with an extension that somehow has been connected to Notepad. Is it a default extension, or was it added later? Is it a single file, or are there dozens of them? (Of course, the association with Notepad *is* that on the suspect computer, and not on the examination computer, right?)
Notepad is used for 'pure' text files, without any major metadata overhead. You essentially only have a choice between 8-bit characters and 16-bit characters (ANSI and Unicode). There is no such thing as 'text colour' that's stored in the file – it's something you define yourself. You may want to ensure that you are using a Unicode typeface (even if that strictly speaking is a contraditcion).
A very quick experiment, however, suggests that it may be legitimate. Create a file containing only NUL characters in your hex editor of choice, and save it with an extension that Notepad uses. Open it in Notepad. Does it behave as the file you are examining? As far as I can see NUL is treated as any other character, so CTRL-A would select them.