by September 6, 2007 0 comments

Lately, a new genre called anti-forensic tools has started gaining
popularity. While forensic tools are meant to trace out data from a stolen
machine, anti-forensic tools do the reverse. They ensure that forensic tools are
not able to find anything. Till now, they were exclusively in the domain of
experts or even hackers to hide their traces,because of their complex nature.
But now they’ve become so simple that anybody can use them to safeguard their
critical data. So if your laptop or hard drive gets stolen, then it will become
very difficult for anybody to take out data from it using forensic tools. We
said ‘almost’ because nothing’s foolproof.

Let’s have a look at three of such tools, all of which are freeware or open

Direct Hit!

Applies To: Advanced users
Safeguard your critical data
Primary Link:

Google Keyword:

This is an open source encryption program, which supports 11 encryption
algorithms and is meant for recent versions of Windows and Linux. It creates an
on-the-fly encryption volume in which data is encrypted automatically when it is
stored and is likewise decrypted when accessed. The created volume is also
password protected.

When data is loaded from the TrueCrypt volume, it decrypts it only on RAM
i.e. no decrypted data is stored on the HDD. A user can copy and access any file
on the encrypted volume, without bothering about the encryption process.
Moreover, this tool lets you create a hidden partition within an existing
TrueCrypt encrypted partition and both these partitions are protected with
different passwords. The benefit of the hidden
partition shows up when you are forced to reveal the password of your TrueCrypt
volume. You can get away by giving password of only the encrypted volume and
still protect the information inside the hidden volume as it won’t be mounted.

Download this tool from www.truecrypt. org and install it. For creating the
encryption volume select ‘Create Volume’ option from the main menu. This will
open up the ‘TrueCrypt Volume Creation’ wizard. In the first step, choose
‘Create a hidden TrueCrypt volume,’ then select ‘Create a TrueCrypt volume and
then a hidden volume within it’ option. To save this volume click on the ‘Select
File’ tab and browse a location to save it. For the outer volume define its
size, encryption and hash algorithms to be used and the password. After this the
outer volume is formatted and you can create a hidden volume. For this you need
to specify the encryption and hash algorithms for the inner volume and also
define its size as well as password. Remember that size of the hidden volume has
to be less than the size of the outer volume, as it is going to reside inside
the outer volume. Lastly the wizard will ask you to select the file system (i.e.
NTFS or FAT) that you want to use for creating the hidden volumes. It will
format the volume and your hidden volume is ready.

To mount the created volume, go to the main menu and under the ‘Volume’
submenu, click on the ‘Select file’ tab, browse to the file that you used to
create your TrueCrypt volume and then click on the ‘Mount’ tab. Now, provide the
password for the hidden volume in the window that pops up and your hidden volume
will be mounted. Once the volume is mounted, you can access it just like any
other partition from ‘My Computer’ and simply dismount it through the
TrueCrypt’s main console.

A hidden and a normal prartition
being mounted inside Truecry using Twofish and Serpent-AES algorithms

This is a stegnographic as well as a cryptographic tool. Using stegnography,
a file can be hidden within another file of same or other format. This technique
is frequently used by digital image publishers for attaching a licensed file
with an image and is similarly used to add copyright information to the images
of a website. This tool lets you hide text files inside any provided .bmp file
and lets you encrypt the resultant file with a password. The changes made to the
resultant .bmp file are unnoticeable to the naked eye.

This is a command line tool that can be downloaded from the You can perform four basic operations with
it-calculate how much data can be stored within a .bmp image file, hide and
restore files from a .bmp image and list the files encrypted in a .bmp image.
Using it is a piece of cake. Just open the command prompt and go to the location
where you have extracted BlindSide files. Now, to check the capacity of a .bmp
image in which you want to hide the files run

BSIDE.exe —C

To hide a file, run the following command

“ BSIDE.exe -A < file to hide> [password]

In the first argument provide name of the .bmp image in which you want to
hide a file and in the second argument provide the name and location of the file
you want to hide inside the image. Password argument is optional, define it, if
you want to encrypt your file with a password. To list files hidden in a .bmp
image run

BSIDE.exe —L

DBAN (Darik’s Boot and Nuke) is a tool for securely wiping contents of a
hard disk . It provides six methods for wiping that include Quick Erase, RCMP
TSSOT OPS-II, DOD Short, DoD 5220.22-M,Gutmann Wipe, PRNG Stream. Quick Erase
fills the hard drive with zeros, while Gutmann wipe performs 27 random passes
with a specific data pooled with eight passes of random data. DoD Short method
makes 1, 2 and 7 of seven passes recommended in DoD 5220.M standard.
DoD5220-22.M standard fills the Hard disk using random characters and data
streams. The ‘PRNG stream’ method fills the device with a stream from
pseudorandom number generator(PRNG).This utility comes embedded with two PRNG’s
namely Mersenne Twister and ISAAC.

To wipe a Hard disk with DBAN, you need to boot the machine with DBAN media
that can be downloaded from You can install a DBAN on
a floppy drive, USB drive, CD or a DVD drive. Once you have booted from DBAN
media, it will ask you to select the mode you want to run it in. To
automatically wipe off your HDD without any further prompting, type ‘autonuke’
in the boot option and press ‘Enter.’ To start it in an interactive mode just
press ‘Enter,’ you would be asked to select the partition you want to wipe.
Press ‘M’ to
select a method from the list of six available methods for wiping and press ‘Enter’.To
start wiping process of the drives press F10. Once DBAN has wiped all the
drives, it will ask you to insert a floppy disk on which it will save the log
files,and then you are done.

In DBAB you can choose amongst
six wiping methodes for disk using the same method

No Comments so far

Jump into a conversation

No Comments Yet!

You can be the one to start a conversation.