Password, Hidden Data and Packer Tools

What it is

Suspects protect and hide data with passwords, steganography, alternate data streams, renamed files, packers and wiping. Investigators use tools to open protected data legally and to detect concealment. This page covers what each tool class does and how detection works.

The exam asks which tool or technique fits a situation and what each finds.

How it works

Rainbow tables

A rainbow table is a precomputed table of hash chains that trades storage for speed in reversing unsalted hashes. The lookup finds a password for a hash without hashing every guess at run time. RainbowCrack (rtgen, rtsort, rcrack) and Ophcrack use them.

Salting defeats them: a unique random salt per password makes precomputed tables useless. Slow hashes such as bcrypt, scrypt and Argon2 also resist. NTLM hashes are unsalted, which is why rainbow tables work well against old Windows hashes.

Password cracking tools

Tools: John the Ripper and Hashcat (offline hash cracking, Hashcat uses GPUs), Hydra (online login attempts), L0phtCrack, Cain and Abel, and the commercial Passware Kit and AccessData PRTK for files and containers. Offline cracking works on a copy of the hash file such as SAM and SYSTEM, so it does not touch the live system or trigger lockouts.

Reset admin password tools

Offline tools boot from media. Offline NT Password and Registry Editor (chntpw) and PCUnlocker edit the local account database, while Kon-Boot patches the logon check in memory at boot without changing the stored password. They apply to local accounts, not domain accounts.

Resetting a password changes the evidence and the user's logon state. Use it on a copy or when no other path exists, and document it.

Steganography detection tools

Steganalysis looks for hidden data inside carrier files. Visual inspection, statistical tests such as chi square, and signature checks reveal anomalies. Tools: StegExpose, StegDetect, StegSpy, zsteg and StegoHunt, a commercial WetStone product that scans files, memory images and processes for steganography programs and carriers. No steganalysis tool finds hidden data every time. Large BMP and lossless carriers, a file bigger than expected for its content, and data after a JPEG end marker are clues.

OSForensics and hidden data

OSForensics, a Windows triage and analysis tool, can search file systems for deleted files and run its Mismatch File Search to flag files whose extension does not match the content. It also indexes and hashes files for matching with known sets.

ADS detection tools

NTFS alternate data streams attach hidden data to a file.

Get-Item .\notes.txt -Stream *
streams.exe -s C:\Users

Detecting file extension mismatch using Autopsy

Autopsy has an Extension Mismatch Detector ingest module. It compares the extension with the file's signature (the file type from its header) and lists files that differ, such as a JPEG named .dll. Run it with the file type identification module, then review the Extension Mismatch results.

Tools to detect overwritten data and metadata

Overwriting leaves traces. The NTFS $MFT, $LogFile and $UsnJrnl show file operations. Tools such as MFTECmd and NTFS Log Tracker parse these. Timestamps in $STANDARD_INFORMATION that disagree with $FILE_NAME, and gaps in the journal, point to timestamp changes or wiping. Wiping tools often leave their own prefetch entries and registry traces.

Program packer unpacking tools

A packer compresses or encrypts an executable and adds a stub that restores it at run time, which hides code from static analysis. Detection tools: Detect It Easy, PEiD and Exeinfo PE, which identify packers by signatures and section names. Signs include high entropy, few imports and odd section names. UPX can be reversed with its decompress option (upx -d). Others require running the program in a controlled sandbox or debugger.

USB device enumeration using PowerShell

Windows keeps a record of connected USB storage in the registry.

Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select-Object FriendlyName, PSChildName
Get-PnpDevice -Class USB

The USBSTOR key lists device make, model and serial. A device without a unique serial gets a Windows generated ID, so check the instance ID. Other sources are MountedDevices, the user's MountPoints2, and the setupapi.dev.log file in Windows\INF, which records the first connection time.

A worked example

An examiner finds a 40 MB JPEG that displays a small picture. A statistical test flags the file, and a hex editor shows data after the FF D9 marker.

The examiner notes the offset, carves the extra data from the image copy, hashes it, and checks the USBSTOR key to see which USB device carried the file.

How the exam asks about this

• "Which defense makes rainbow tables ineffective?" → Salting the passwords.
• "Which Autopsy module finds a renamed file?" → The Extension Mismatch Detector.
• "Which registry key lists USB storage devices connected to Windows?" → USBSTOR under CurrentControlSet\Enum.