HIDEINSIDE — A novel randomized & encrypted antiforensic information hiding

Several techniques have been proposed for information hiding including hiding in slack space, which is the focus of this paper. However, current techniques of hiding in slack space depend on utilizing exiting slack space on the disk, which can be seriously limiting. Also, all techniques proposed thus far for hiding in slack space are impacted by the cluster size on the disk since the maximum slack space is a function of the cluster size. This necessitates splitting the data to be hidden into numerous parts, making it cumbersome to remember their locations and sequence for reassembly. Finally, hiding in existing slack space risks loss of data due to overwriting if the file - whose slack is used for hiding - grows in size. In this paper we propose - HIDEINSIDE - a novel on-demand slack space generator that creates new files on-the-fly that act as the cover file for hiding. The proposed method is an Antiforensics as well as a Steganographic technique. With HIDEINsIDE, the information to be hidden is split into n chunks - where n is the number of cover files created. The number of cover files created depends on the amount of data to be hidden and the size of the clusters. Each chunk of data is then encrypted and stuffed randomly into the slack space of one of the n cover files along with the MD5 hash value of the encrypted chunk. We finish the hiding process by creating a map-file of the randomly hidden chunks such that they can be easily reassembled in the correct sequence upon retrieval. The MD5 hash verifies the integrity of the retrieved chunks before they are deciphered. The map-file resides on an external drive making it extremely difficult, if not impossible, to locate, decrypt and reassemble the hidden chunks in the correct order to retrieve the hidden information.