New paper: Analysis of hidden data in the NTFS file system
Oh, hang on, I think I know what the problem is 😉
What, you think the little guy in the picture has hidden the image file? He does look a little suspicious.
Or does the image not exist in the /images/other directory?
OK, this little mystery should now be solved…
Originally I was going to add the tables as images but in the end just used HTML. However, I forgot to remove the IMG SRC statements I'd already included in the body of the text.
I had assumed that those who stated they couldn't see the images were talking about ALL the images but I suspect they were seeing some (i.e. fig1.gif, fig2.gif, etc.) but not the "missing" table graphics.
I've now removed the superfluous IMG SRC lines, does everthing look good to everyone now?!!
That appears to have done the trick… So the stuff was there all along, we just thought there was something missing because of the broken links…
But it would still be nice to see this paper in PDF, or printer friendly format.
I think it's great that some of my work was referenced…although more is available WRT NTFS alternate data streams.
I just wish that the author had gotten my first initial correct.
Filed under "B", for "Harlan"
I've corrected that error now.
i've created a PDF if anyone wants a copy
Oh, that's very useful, I had emailed the author to see if he already had one but if you've got one available feel free to mail it to me if you wish and I'll add it to the articles index as an alternative to viewing the HTML.
I'm sure there's a joke here somewhere ("How many forensic computing practitioners does it take to find a missing image…") 😉
Just a quick note, the PDF is now available at http//www.forensicfocus.com/downloads/ntfs-hidden-data-analysis.pdf and linked to from the papers page.
Thanks to Kai Wee and Paul for both supplying the file.
Thanks to the person who posted this VERY informative and helpful indeed
A very nice read, thanks!
I liked it. Excellent information
Hi everybody, 8)
Thanks a lot… very new to computer forensic. i believe this article will broaden my view when dealing with a pc. 😯
Note my first post…. )
i can see too