StegoMft

joakims · 2013-12-11T03:47:03Z

Just a PoC I made to show how one could hide data within NTFS system files, in this case $MFT and its record slack.http//code.google.com/p/mft2csv/wiki/StegoMftIt has been through basic testing, and seems to work fine. However, regard it as highly experimental and provided for educational purposes, and expect there to be bugs. I strongly advice to not run it on a production volume, yet, until properly tested. Performance is also not amazing, at least not for the good. Only documentation is currently only a short readme included in the download. Though I guess it is self-explanatory, from the examples.But it is interesting… )

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by joakims 13 years ago

11 Posts

4 Users

0 Reactions

2,321 Views

RSS

joakims

(@joakims)

Estimable Member

Joined: 16 years ago

Posts: 224

Topic starter 08/01/2014 11:54 pm

Just realized that the technique was presented at blackhat back in 2006 along with FragFS; http//www.blackhat.com/presentations/bh-federal-06/BH-Fed-06-Thompson/BH-Fed-06-Thompson-up.pdf

Never tried the tool though. And from googling I don't think the source was ever released either.. From the doc it seems to share some similarity in the logic, however that implemetation sounds to be slightly different.

ReplyQuote

Page 2 / 2 Prev