14 January 2008 1 Comment Files can be “hidden” on a filesystem
in several ways; some are just attempts to “hide in plain
sight.” This is not hiding data in files (such as steganography)
but rather hiding the mere existence of files themselves. There
are several ways to do this. The basic ideas are: - Make
reporting tools lie about the existence of files. This falls
into the realm of “rootkits.” Utilities such as ls (and even the
kernel itself) may modified in order to not report the existance
a particular file. A way to avoid this is to use programs
(during examination) that are statically linked and precompiled
and saved to read-only media: such programs are immune to future
modifications, except for kernel resources (if the kernel is
taken over, then all other resources are suspect). - Make files
“disappear” in file listings. Files of this sort include “.. ”
(two dots followed by a space) and other non-standard
characters. These files look normal but are not. One way to see
files like these is to use the l