The use of digital forensic tools by law enforcement agencies has made it difficult for malicious individuals to hide potentially incriminating evidence. To combat this situation, the hacker community has developed anti-forensic tools that remove or hide electronic evidence for the specific purpose of undermining forensic investigations. This paper examines the latest techniques for hiding data in the popular Ext2 and Ext3 file systems. It also describes techniques for detecting hidden data in the reserved portions of these file systems.

No abstract

The practice of digital forensics demands thorough, meticulous examinations of all data storage media seized in investigations. However, BIOS chips and other firmware are largely overlooked in forensic investigations. No forensically sound procedures exist for imaging BIOS chips and no tools are available specifically for analyzing BIOS image files. Yet, significant amounts of data may be stored on BIOS chips without hindering machine performance. This paper describes robust techniques for concealing data in BIOS freespace, BIOS modules, and throughout a BIOS chip. Also, it discusses how flashing utilities and traditional digital forensic tools can be used to detect and recover concealed data.

The storage and handling of digital evidence are creating significant challenges for federal, state and local law enforcement agencies. The problems include acquiring and processing massive amounts of digital evidence, maintaining the integrity of the evidence, and storing digital evidence for extended periods of time. This paper describes a networkbased storage architecture that helps address these issues. The architecture also supports collaborative efforts by examiners and investigators located at geographically dispersed sites.

The U.S. Public Telephone Network (PTN) is a massively connected distributed information system, much like the Internet. PTN signaling, transmission and operations functions must be protected from physical and cyber attacks to ensure the reliable delivery of telecommunications services. The increasing convergence of PTNs with wireless communications systems, computer networks and the Internet itself poses serious threats to our nation's telecommunications infrastructure. Legacy technologies and advanced services encumber well-known and as of yet undiscovered vulnerabilities that render them susceptible to cyber attacks. This paper presents a taxonomy of cyber attacks on PTNs in converged environments that synthesizes exploits in computer and communications network domains. The taxonomy provides an opportunity for the systematic exploration of mitigative and preventive strategies, as well as for the identification and classification of emerging threats.