KR20230139661A - Apparatus and method for detecting and extracting hidden area and hidden files created using the FbinstTool - Google Patents

Abstract

The present invention relates to an apparatus and method for detecting a hidden area created in a storage medium using FbinstTool and reliably extracting hidden files hidden in the hidden area. The above method checks the signature of FbinstTool in the MBR area, obtains location information of the File_List area and File_Data area in the SubMBR area, extracts metadata if metadata of a hidden file exists in the File_List area, and extracts the extracted metadata. Use to extract the data of the hidden file from the File_Data area.

Description

Apparatus and method for detecting and extracting hidden area and hidden files created using the FbinstTool}

The present invention relates to an apparatus and method for detecting a hidden area created in a storage medium using FbinstTool and reliably extracting hidden files hidden in the hidden area.

File hiding technology refers to a technique for hiding files without significantly affecting the original file or image. Various file hiding methods have been disclosed in the past.

For example, in Publication Patent Publication No. 10-2018-0084585 (Prior Document 1), a method of hiding files by specifying a location address is disclosed to increase security from the risk of file hacking, and in Publication Patent Publication No. 10-2021-0097294 (Prior Document 2) discloses a technology for hiding a file created in a specific path of a terminal in another file to increase the security level of the terminal. These prior documents 1 and 2 hide files in other files or images.

However, recently, there have been attempts to make files on storage media difficult to find for a specific purpose and to hide the files so that they can be used for a specific purpose later. If files are hidden with malicious intent, technology to detect and extract them is required.

The operating system of a computing device refers to the Master Boot Record (MBR) area when determining the structure of the storage medium. There is an area in the partition entry of the MBR area that records partition information of the storage medium, and by analyzing the area, the status of the partition can be determined. Most Windows Explorer, disk managers, and digital forensic file system analysis tools have a function to analyze partition status based on information in the MBR area.

Creating a hidden area on a storage medium has the same meaning as creating a hidden partition. Since information about storage media partitions is stored in the MBR area of the file system, the operating system can determine the status of all partitions existing in the storage medium by analyzing only the small MBR area of 512 bytes.

Therefore, most digital forensic file system analysis tools are equipped with functions to analyze the partition status of such storage media, and the same goes for Windows' disk management function and explorer.

However, if you use the FbinstTool program to create a hidden area on the storage medium, even Windows and professional digital forensic tools such as EnCase, FTK Imager, Autopsy, and X-ways Forensics cannot detect the hidden area. The method of extracting the internal data is also unknown.

FbinstTool, an open source tool, allows users to create a hidden area (hidden partition) by specifying its size, and is also included and used in other multi-boot USB creation tools.

To date, there has been no research on the hidden areas created in storage media using FbinstTool, and existing digital forensic tools and tools built into the Windows operating system cannot detect these hidden areas.

Since the hidden area that can be created with FbinstTool is highly likely to be used with malicious intent from an anti-forensic perspective, the development of technology to detect and extract it is required in the relevant technical field.

(Prior Document 1) Publication of Patent No. 10-2018-0084585 (Prior Document 2) Public Patent Publication No. 10-2021-0097294

The purpose of the present invention is to provide an apparatus and method for detecting a hidden area created in a storage medium using FbinstTool.

The purpose of the present invention is to provide an apparatus and method for extracting hidden files hidden in a hidden area created in a storage medium using FbinstTool.

The purpose of the present invention is to provide an apparatus and method for recovering hidden files deleted from a hidden area created in a storage medium using FbinstTool.

A method for detecting and extracting a hidden area and a hidden file created using FbinstTool according to an embodiment of the present invention includes a recognition step of recognizing a storage medium; A confirmation step of checking the signature of FbinstTool in the MBR area of the storage medium; When the signature is confirmed, obtaining location information of the File_List area and File_Data area in the SubMBR area; A determination step of determining whether metadata of a hidden file exists in the File_List area; A first extraction step of extracting the metadata if the metadata exists; and a second extraction step of extracting data of the hidden file from the File_Data area using the extracted metadata.

In the present invention, after the determination step, if the metadata of the hidden file does not exist in the File_List area, it is determined whether the data of the hidden file exists in the File_Data area, and if so, the data of the hidden file is extracted. 3 Additional extraction steps may be included.

In the present invention, determining whether data of the hidden file exists in the File_Data area or determining whether an unallocated area or slack area exists in the File_Data area after the second or third extraction step; If the unallocated area or slack area exists, extracting the unallocated area or slack area and recovering data of the hidden file deleted from the extracted area; And it may further include extracting the recovered data.

In the present invention, the determining step may further include determining whether there is a plurality of MBR areas when the storage medium is recognized.

In the present invention, the determination step determines whether the MBR area repeats 64 MBR areas from sector 0 to sector 63.

In the present invention, the determination step determines whether the signature exists in 0x1B4 to 0x1B7 of the MBR area for each sector.

In the present invention, the SubMBR area exists from sector 64 to sector 67.

An apparatus for detecting and extracting a hidden area and a hidden file created using FbinstTool according to an embodiment of the present invention includes a memory storing a first program for detecting and extracting a hidden area and a hidden file created by FbinstTool; A processor executing the first program, wherein the processor executes the first program to check the signature of FbinstTool in the MBR area of the storage medium and obtain location information of the File_List area and File_Data area in the SubMBR area. , metadata of the hidden file is extracted from the File_List area, and data of the hidden file is extracted from the File_Data area using the metadata.

In the present invention, if metadata of the hidden file does not exist in the File_List area, the processor determines whether data of the hidden file exists in the File_Data area and, if so, extracts the data of the hidden file.

In the present invention, if an unallocated area or slack area exists in the File_Data area, the processor extracts the unallocated area or slack area, recovers the data of the hidden file deleted from the extracted area, and restores the recovered data. Extract data.

In the present invention, the processor checks the signature of FbinstTool in the MBR area, and when the MBR area repeats from sector 0 to sector 63, it obtains location information of the File_List area and File_Data area in the SubMBR area.

In the present invention, the processor checks whether the signature exists in 0x1B4 to 0x1B7 of the MBR area for each sector.

The apparatus and method for detecting and extracting hidden areas and hidden files created in a storage medium using FbinstTool according to an embodiment of the present invention has the following effects.

According to the present invention, the hidden area created in the storage medium can be detected using FbinstTool.

According to the present invention, hidden files hidden in a hidden area created in a storage medium can be extracted using FbinstTool.

According to the present invention, hidden files deleted from the hidden area created in the storage medium can be recovered using FbinstTool.

1 is a configuration diagram of a device for detecting a hidden area and extracting a hidden file by FbinstTool according to an embodiment of the present invention.
Figure 2 is a structural diagram of a file system when creating a hidden area using FbinstTool according to an embodiment of the present invention.
Figure 3 is a diagram illustrating the MBR area according to an embodiment of the present invention.
Figure 4 is a diagram illustrating the SubMBR area according to an embodiment of the present invention.
Figure 5 is a diagram illustrating the File_List area according to an embodiment of the present invention.
Figure 6 is a diagram explaining the File_Data area according to an embodiment of the present invention.
Figure 7 is a flowchart showing a method for detecting and extracting a hidden area and a hidden file created using FbinstTool according to an embodiment of the present invention.
Figure 8 is a flow chart showing the process of recovering and extracting data of a hidden file deleted from the File_Data area in another embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail through illustrative drawings. When adding reference numerals to components in each drawing, it should be noted that identical components are given the same reference numerals as much as possible even if they are shown in different drawings. Additionally, when describing embodiments of the present invention, if detailed descriptions of related known configurations or functions are judged to impede understanding of the embodiments of the present invention, the detailed descriptions will be omitted.

The present invention relates to a method of detecting and extracting hidden files from a storage medium using FbinstTool. The method of the present invention can be applied not only to a built-in storage medium inside the computing device, but also to an external storage medium that is removable from the computing device.

Hereinafter, a method for detecting and extracting a hidden area and a hidden file created using FbinstTool according to an embodiment of the present invention will be described in detail with reference to the attached drawings.

1 is a configuration diagram of a device for detecting and extracting a hidden area and hidden files created using FbinstTool according to an embodiment of the present invention.

Referring to FIG. 1, the device 100 (hereinafter referred to as device 100) for detecting and extracting hidden areas and hidden files created using FbinstTool according to an embodiment of the present invention includes a processor 110. It may be configured to include a memory (memory) 120.

The memory 120 can store a plurality of programs and data, and the processor 110 can execute the programs stored in the memory 120.

One of the plurality of programs stored in the memory 120 may be a first program that detects and extracts the hidden area and hidden files created using FbinstTool. Accordingly, the processor 110 may execute the first program to detect and extract the hidden area and hidden file created by FbinstTool.

The processor 110 may be, for example, a central processing unit (CPU) that constitutes a computing device, and the memory 120 may be a storage device that stores files, data, programs, software, etc., such as a disk device. Memory 120 may preferably be embedded in the computing device, and may also be externally connected and disconnected.

Figure 2 is a structural diagram of a file system of a hidden area created using FbinstTool according to an embodiment of the present invention.

The file system 200 of the hidden area created using FbinstTool manages data based on sectors (512 bytes, 0x200) like existing FAT and NTFS systems. However, in order to create and manage the hidden area, it has a different metadata area than the existing file system.

Referring to FIG. 2, when a hidden area is created using FbinstTool, 64 MBR areas 210 differing only in the partition table area are repeated from sector 0 to sector 63. From sectors 64 to 67, there is a SubMBR area 220 that assists the MBR area 210.

And, behind the SubMBR area 220, there is a File_List area 230 that stores metadata of internal files in the hidden area and a File_Data area 240 that stores actual data of files in the hidden area.

Using FbinstTool, you can create two types of hidden areas in the File_Data area (240): Primary area (241) and Extended area (242). Here, the primary area 241 is necessarily created and the extended area 242 can be selectively created by the user. If the user does not create the Extended area (242), only the Essentially created Primary area (241) can exist in the File_Data area (240).

The device 100 of the present invention detects the hidden area and hidden files using the characteristic information of the primary area 241 and the extended area 242, and then extracts the hidden files and recovers deleted files. You can.

Figure 3 is a diagram explaining the MBR area according to an embodiment of the present invention.

Referring to FIG. 3, when a hidden area is created using FbinstTool, 64 MBR areas 210 are repeated from sector 0 to sector 63. These 64 MBR areas 210 differ only in the partition table areas, and the data they consist of is all the same.

In the example of FIG. 3, the MBR area 210 includes information about the area. For example, it includes the byte offset of sector 0 and information about it, and also includes data of sector 0.

In the MBR area 210 created using FbinstTool, there is a signature (0x46424246) of FbinstTool with a size of 0x04 at 0x1B4 to 0x1B7. Like this, when a hidden area is created by FbinstTool, the signature of FbinstTool must exist in that location. Therefore, this signature is evidence that the hidden area was created by FbinstTool.

Looking at the data structure of FIG. 3, in the MBR area 210 created by FbinstTool, data of FbinstTool's signature (0x46424246) must exist in 0x1B4 to 0x1B7 of sector 0, and the data appears to be English letters FBBF.

Therefore, in the present invention, the processor 110 executes the first program stored in the memory 120 to determine whether the signature of FbinstTool exists in 0x1B4 to 0x1B7 in the MBR area 210, thereby determining that the hidden area has been created by FbinstTool. there is.

At this time, additionally or alternatively, the processor 110 may check whether the 64 MBR areas 210 from sector 0 to sector 63 are repeated. If the MBR area 210 is repeated, reliability of the existence of the hidden area can be further increased by checking whether the signature of FbinstTool exists in the MBR area 210.

Figure 4 is a diagram explaining the SubMBR area according to an embodiment of the present invention.

Referring to FIG. 4, when a hidden area is created using FbinstTool, a SubMBR area 220 exists from sectors 64 to 67. In the example of FIG. 4, the SubMBR area 220 includes information about the corresponding area. For example, it includes byte offsets of sectors 64 and 67 and information about them, and also includes data of sectors 64 and 67.

In the SubMBR area (220), 0x8008 to 0x8009 contain size information of the File_List area (230), 0x800A to 0x800B contain size information of the Primary area (241) of the File_Data area (240), and 0x800C to 0x800F contain information on the size of the File_Data area (240). ) There is information on the size of the extended area (242). Additionally, 0x8004 to 0x8005 of the SubMBR area 220 contains Fbinst_version information, that is, version information of FbinstTool. The version information of FbinstTool can be important information in understanding the characteristics of FbinstTool.

Therefore, in the present invention, the processor 110 executes the first program stored in the memory 120 to extract the SubMBR area 220 from the file system 200 and extracts the File_List area (File_List area) where metadata of the file stored in the hidden area is present. 230) and size information of the File_Data area 240 can be obtained. The size information of each area can be the location information of each area.

Figure 5 is a diagram explaining the File_List area according to an embodiment of the present invention.

Referring to FIG. 5, when a hidden area is created using FbinstTool, a File_List area 230 exists in sector 68 in the structure of the file system 200. In this File_List area 230, metadata of hidden files stored in the hidden area are stored.

In Figure 5, for example, information of the File_List area 230 is shown on the upper side, and data of the File_List area 230 is shown on the lower side. Looking at the data in the File_List area 230, for example, it appears that two txt files, File01.txt and File02.txt, are stored in order.

At this time, metadata of the File_List area 230 includes information about hidden files. That is, it includes information such as location, size, storage time, and modification time of hidden files. Figure 5 shows, for example, that File01.txt is stored in the Primay area (241) and File02.txt is stored in the Extended area (242).

As such, in the present invention, the processor 110 executes the first program stored in the memory 120 to check the metadata of the file hidden in the File_List area 230 of the file system 200, and through this metadata Be sure to check hidden files.

Figure 6 is a diagram explaining the File_Data area according to an embodiment of the present invention.

Referring to FIG. 6, when a hidden area is created using FbinstTool, a File_Data area 240 exists in a specific sector in the structure of the file system 200. In this File_Data area 240, the actual data of the hidden file stored in the hidden area is stored. Actual data may be stored in the primary area 241, and may also be stored in the primary area 241 and extended area 242.

In Figure 6, for example, it is shown that the File_Data area 240 exists in sector 967. In the primary area 241, data of 510 bytes can be stored in the first sector of sectors 967, excluding the last 2 bytes of the sector number, and in the extended area 242, 512 bytes of data can be stored in the first sector. You can see that it can be saved.

And, Figure 6 illustrates that the file File01.txt is stored as an example, and the content of the file is "This is File1This is File1This is File1."

As such, in the present invention, the processor 110 can execute the first program stored in the memory 120 to check the hidden file stored in the File_Data area 240 of the file system 200 and extract it.

Meanwhile, another one of the plurality of programs stored in the memory 120 according to the present invention may be a second program that detects hidden files deleted from the hidden area created using FbinstTool and extracts them. Accordingly, the processor 110 may execute the second program to detect and extract the hidden file deleted from the hidden area.

When a hidden file is deleted from the hidden area created with FbinstTool, a Slcak area exists as a trace of the deletion. Specifically, there is a slack area in the File_Data area 240, which is a trace of a file that previously existed in the File_Data area 240 and was deleted.

In another embodiment of the present invention, the processor 110 executes the second program stored in the memory 120 to check the slack area in the File_Data area 240 and recover the data of the file that was present in the slack area and then deleted. Carving work can be performed.

Additionally, when a hidden file is deleted in the File_Data area 240, a zeroizing process is performed in which the metadata of the deleted hidden file is initialized to the value 0x00 in the File_List area 230. Since the metadata of other hidden files that immediately follow the deleted file is moved forward in the zeroized area, the metadata of the deleted file may not be recoverable. However, since the actual data existing in the File_Data area 240 is not deleted, some or all of the deleted data can be recovered by recovering this.

Figure 7 is a flowchart showing a method for detecting and extracting a hidden area and a hidden file created using FbinstTool according to an embodiment of the present invention.

Referring to FIG. 7, in the method for detecting and extracting a hidden area and a hidden file created by FbinstTool according to an embodiment of the present invention, the processor 110 in the computing device recognizes the storage medium (S101). When the storage medium is recognized, the processor 110 executes the first program stored in the memory 120 (S102) and determines whether the signature of FbinstTool exists in the MBR area 210 of the storage medium (S103). Here, the processor 110 checks whether the signature of FbinstTool exists in 0x1B4 to 0x1B7 of the MBR area 210. If the signature of FbinstTool exists in the MBR area (210), it is confirmed that a hidden area created by FbinstTool exists (104).

Here, the processor 110 may optionally perform an additional operation to make it more certain whether the hidden area created by FbinstTool exists. That is, if the processor 110 determines that the signature of FbinstTool exists in the MBR area 210, it can further determine whether 64 MBR areas 210 repeatedly exist from sector 0 to sector 63 of the file system. there is. If the MBR area 210 exists repeatedly, it can be confirmed that a hidden area created by FbinstTool exists. In addition to confirming the presence or absence of the FbinstTool signature, the reliability of confirmation of the hidden area by FbinstTool can be further increased by checking the repetitive presence of the MBR area 210.

Afterwards, the processor 110 selects a File_List area 230 in which the metadata of the hidden file stored in the hidden area exists in the SubMBR area 220 from sectors 64 to 67, and a File_Data area in which the actual data of the hidden file exists. Size information of the area 240 is obtained (S105).

Since the File_List area 230 and File_Data area 240 are located immediately behind the SubMBR area 220 in the file system structure, using the size information of the File_List area 230 and File_Data area 240, the File_List area 230 and the location of the File_Data area 240 can be known. Therefore, obtaining size information of the File_List area 230 and File_Data area 240 means confirming the locations of the File_List area 230 and File_Data area 240.

Accordingly, the processor 110 checks the positions of the File_List area 230 and the File_Data area 240 and first determines whether metadata of the hidden file exists in the File_List area 230 (S106). If metadata of the hidden file exists in the File_List area 230, the processor 110 extracts the metadata of the hidden file (S107), and the processor 110 uses the extracted metadata to store the metadata in the File_Data area 240. Extract data from hidden files (S108).

At this time, even if metadata of the hidden file does not exist in the File_List area 230, data of the hidden file may exist in the File_Data area 240. Therefore, in step S106, even if metadata of the hidden file does not exist in the File_List area 230, the processor 110 determines whether data of the hidden file exists in the File_Data area 240 (S109). If data of a hidden file exists in the File_Data area 240, the processor 110 extracts the data (S108).

Meanwhile, in another embodiment of the present invention, even if the data of the hidden file is deleted selectively or additionally, it can be recovered and extracted. For example, after extracting the data of the hidden file from the File_Data area 240 (S108 or S110), or if the data of the hidden file does not exist in the File_Data area 240 (S109), it is necessary to check whether the data of the hidden file has been deleted. If it has been confirmed and deleted, it can be restored and extracted.

Figure 8 is a flowchart showing the process of recovering and extracting data of a hidden file deleted from the File_Data area in another embodiment of the present invention.

Referring to FIG. 8, the processor 110 determines whether an unallocated area or slack area exists in the File_Data area 240 (S201). The unallocated area of the File_Data area 240 is not an area allocated for data storage, but an area that has not yet been allocated because data has not been stored, and the slack area is an area that has traces of being previously saved and deleted. It means area. When data is deleted, it may exist as an unallocated area or as a slack area.

Accordingly, if it is determined that an unallocated area or slack area exists in the File_Data area 240, the processor 110 extracts the unallocated area or slack area (S202) and deletes it from the extracted unallocated area or slack area. A carving operation is performed to recover the data of the deleted hidden file using traces of the hidden file (S203). Then, the recovered data is extracted (S204).

When the data of the hidden file is deleted, the metadata of the deleted file in the File_List area 230 is zeroized and initialized to the value 0x00. Afterwards, the metadata of other hidden files that exist behind the zeroized area are moved to the front, so the metadata information of the deleted file cannot be recovered. However, since the actual data existing in the File_Data area is not deleted, some or all of the deleted data can be recovered by recovering this.

The above description is merely an illustrative explanation of the technical idea of the present invention, and various modifications and variations will be possible to those skilled in the art without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but rather to explain it, and the scope of the technical idea of the present invention is not limited by these examples. The scope of protection of the present invention should be interpreted in accordance with the claims below, and all technical ideas within the equivalent scope should be construed as being included in the scope of rights of the present invention.

110: Processor 120: Memory
210: MBR area 220: SubMBR area
230: File_List area 240: File_Data area

Claims (12)

Verification step of checking the signature of FbinstTool in the MBR area of the storage medium;
An acquisition step of obtaining location information of the File_List area and File_Data area in the SubMBR area when the signature is confirmed;
A determination step of determining whether metadata of a hidden file exists in the File_List area;
A first extraction step of extracting the metadata if the metadata exists; and
A method for detecting and extracting a hidden area and a hidden file created by FbinstTool, including a second extraction step of extracting data of the hidden file from the File_Data area using the extracted metadata. The method of claim 1, after the determination step,
If the metadata of the hidden file does not exist in the File_List area, FbinstTool further includes a third extraction step of determining whether data of the hidden file exists in the File_Data area and extracting the data of the hidden file if it exists. Methods for detection and extraction of created hidden areas and hidden files. The method of claim 1 or 2, when determining whether data of the hidden file exists in the File_Data area, or after the second extraction step or the third extraction step,
determining whether an unallocated area or slack area exists in the File_Data area;
If the unallocated area or slack area exists, extracting the unallocated area or slack area and recovering data of the hidden file deleted from the extracted area; and
A method for detecting and extracting a hidden area and a hidden file created by FbinstTool, further comprising extracting the recovered data. The method of claim 1, wherein the determination step is,
When the storage medium is recognized, the method of detecting and extracting a hidden area and a hidden file created by FbinstTool further includes the step of determining whether the MBR area is plural. The method of claim 4, wherein the determination step is,
The MBR area is a method for detecting and extracting hidden areas and hidden files created by FbinstTool, which determines whether 64 MBR areas from sector 0 to sector 63 are repeated. The method of claim 5, wherein the determination step is,
A method for detecting and extracting a hidden area and a hidden file created by FbinstTool for determining whether the signature exists in 0x1B4 to 0x1B7 of the MBR area for each sector. The method of claim 1, wherein the SubMBR area exists from sectors 64 to 67 and a hidden area created by FbinstTool and a method for detecting and extracting hidden files. a memory storing a first program for detecting and extracting hidden areas and hidden files created by FbinstTool;
A processor executing the first program;
The processor,
Execute the first program to check the signature of FbinstTool in the MBR area of the storage medium, obtain location information of the File_List area and File_Data area in the SubMBR area, extract metadata of the hidden file from the File_List area, and extract the metadata from the File_List area. A device for detecting and extracting hidden areas and hidden files created by FbinstTool, which extracts data of the hidden files from the File_Data area using. The method of claim 8, wherein the processor:
If the metadata of the hidden file does not exist in the File_List area, the hidden area and hidden file created by FbinstTool determines whether data of the hidden file exists in the File_Data area and extracts the data of the hidden file if it exists. Detection and extraction devices. The method of claim 8 or 9, wherein the processor:
If an unallocated area or slack area exists in the File_Data area, it is generated by FbinstTool, which extracts the unallocated area or slack area, recovers the data of the hidden file deleted from the extracted area, and extracts the recovered data. A device for detecting and extracting hidden areas and hidden files. The method of claim 8, wherein the processor:
Detection of hidden areas and hidden files created by FbinstTool by checking the signature of FbinstTool in the MBR area and obtaining location information of the File_List area and File_Data area in the SubMBR area when the MBR area is repeated from sector 0 to sector 63. and extraction device. The method of claim 11, wherein the processor:
A device for detecting and extracting hidden areas and hidden files created by FbinstTool that checks whether the signature is present in 0x1B4 to 0x1B7 of the MBR area for each sector.

Images