Bad out of Hell - FAT File System
This training is about how to hide data on storage media, by abusing the file systems 'defect cluster' mechanism.
Many file systems still provide the feature to mark clusters, with defect sectors inside, as defect. This feature was needed, to handle storage media which come without it own controller, and avoid the operating system to try working with defect clusters.
Fraudsters can abuse this feature to hide data persistently on the storage media, as this sectors/clusters are circumvent and not used any more. typical use cases could be APT, AntiVirus circumvent or data ex-filtration.
We will explore how file systems do some of their most important activity. We will explore how this is implemented by the FAT32 file system. We will use this techniques on hands-on exercises to hide data in bad clusters And we will learn how to forensically detect such kind of data.
Since 2010, Michael Hamm has been working as an operator and analyst at CIRCL – Computer Incident Response Centre Luxembourg where he is working on forensic examinations and incident response.