Detecting and Manipulating Compressed Alternate Data Streams in a Forensics Investigation

Abstract

Data hiding technique through alternate data streams in compressed form is poorly documented and less known among forensic experts. This paper deals with the documentation of compressed ADS and their attributes concerning hiding information, provides a simple technique of creating compressed ADS and using it in a malicious manner. Finally a method is presented in order to detect and manipulate ADS in a proper way, complying with the computer forensic techniques.