The odds are that most files do not completely fill the clusters or blocks they are assigned on the hard drive. Hiding data in the space between the end of a file and the end of its block (or over several blocks) is possible, provided that the “true” file is never changed and overwrites the hidden file (Fig. 7.1). I attempted to use an application called Slacker, which is (or was) apparently part of the Metasploit Framework, but could not find the utility or any mention of it on Metasploit’s site [MF1]. There are pages of Google hits on Slacker, so my guess is that it existed but has been removed from Metasploit since.

Fig. 7.1. Normal file layout on disc (top) and hiding the file evil.jpg in slack space (bottom). Slack space appears in green.

Utilities such as TrueCrypt go above and beyond the password-protected zip file, allowing a user to create a hidden, encrypted partition that appears to the forensics investigator as a partition of random bits. Won’t that raise suspicions? Perhaps, but nothing can be proved beyond the secure formatting of a partition with random data. TrueCrypt does not even leave behind any header information to search for.

When dealing with a situation not covered by the Fourth Amendment (border guards or Mafia thugs, to name two completely distinct examples), a user may find himself in the predicament of facing a skeptical inquisitor. In that event, the person may have had the foresight to create a hidden partition within an encrypted partition. He has placed all the files he needs to hide inside the enveloped partition, and files that won’t get him arrested or fitted for cement galoshes are in the outer partition. When faced with losing his liberties (or a pinky), he grudgingly — for effect — gives up the password to the outer partition. An investigator would unlock that partition to find some personal files and some random data-filled space, which is exactly what he’d expect from a TrueCrypt volume.

There is even a way to hide an OS within a bootable partition, but really, the only people who need to do that are those embarrassed by the OS they’re using.