Digital evidence obfuscation: recovery techniques

摘要

Criminals who use computers to commit crimes often hide the fruits of the commission of those crimes. Hiding files on a computer can take on many forms, from file names and extensions to more technical methods such as encryption and steganography. Encryption and steganography have the potential to severely impede the recovery of digital evidence. We discuss encryption and steganography below and describe potential methods of coping with each. The techniques we discuss require no special knowledge or advanced hardware or software; however, the use of these techniques does not guarantee the recovery of obfuscated information.