<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Beat EnCase File Signature Analysis on a Windows System</title>
	<atom:link href="http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/feed" rel="self" type="application/rss+xml" />
	<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system</link>
	<description>Rendering computer investigations irrelevant</description>
	<lastBuildDate>Sat, 05 Nov 2011 19:36:26 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3</generator>
<xhtml:meta xmlns:xhtml="http://www.w3.org/1999/xhtml" name="robots" content="noindex" />
	<item>
		<title>By: Anonymous</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-3857</link>
		<dc:creator>Anonymous</dc:creator>
		<pubDate>Sat, 08 Oct 2011 13:29:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-3857</guid>
		<description>I am just throwing this out there but there is rumour that authorities have cracked true crypt. So whats to say the above average black hat hacker has not also managed to obtain this crack.</description>
		<content:encoded><![CDATA[<p>I am just throwing this out there but there is rumour that authorities have cracked true crypt. So whats to say the above average black hat hacker has not also managed to obtain this crack.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jon</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-255</link>
		<dc:creator>Jon</dc:creator>
		<pubDate>Fri, 18 Jun 2010 18:54:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-255</guid>
		<description>Chris Ford, you should not have replied to excalibur ii 1000

excalibur ii 1000 is a spamming bot, I have seen this kind of spam before, if you read again the one line sentence (it is usually a one line sentence), it is written in an ambigous way so that it can be posted at any blog, but that is not what gives it away, what gives &quot;excalibur ii 1000&quot; is:

1) Nickname is &quot;excalibur ii 1000&quot;, a commercial product

2) &quot;excalibur ii 1000&quot; has a signature link to, you guessed it &quot;excalibur ii 1000&quot;

3) &quot;excalibur ii 1000&quot; also links to his minelabexcalibur selling &quot;excalibur ii 1000&quot;

I have no problem with people using their URL at all, but this is not a human being, this is a bot, whom obviously does not read the blog. I have seen spam like this a dozen times before, the traits are: always generic replies, one line sentence, a signature linking to a commercial product.</description>
		<content:encoded><![CDATA[<p>Chris Ford, you should not have replied to excalibur ii 1000</p>
<p>excalibur ii 1000 is a spamming bot, I have seen this kind of spam before, if you read again the one line sentence (it is usually a one line sentence), it is written in an ambigous way so that it can be posted at any blog, but that is not what gives it away, what gives &#8220;excalibur ii 1000&#8243; is:</p>
<p>1) Nickname is &#8220;excalibur ii 1000&#8243;, a commercial product</p>
<p>2) &#8220;excalibur ii 1000&#8243; has a signature link to, you guessed it &#8220;excalibur ii 1000&#8243;</p>
<p>3) &#8220;excalibur ii 1000&#8243; also links to his minelabexcalibur selling &#8220;excalibur ii 1000&#8243;</p>
<p>I have no problem with people using their URL at all, but this is not a human being, this is a bot, whom obviously does not read the blog. I have seen spam like this a dozen times before, the traits are: always generic replies, one line sentence, a signature linking to a commercial product.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Yar (Admin)</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-194</link>
		<dc:creator>Yar (Admin)</dc:creator>
		<pubDate>Thu, 25 Feb 2010 03:06:17 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-194</guid>
		<description>Yes, depending on what type of file and the type of data and the type of OS accessing the data performing this type of data manipulation can render the file useless. 

There are plenty of articles throughout the rest of the site on using TrueCrypt as well. You are very correct in saying that if someone has data that they feel they need to hide or mask then they probably aren&#039;t going to do something tedious like this, but this is not the point of the article.

Yes, EnCase is into the version 6 series which I use as well, in fact I use all versions of EnCase going back to 3. This method exists throughout.</description>
		<content:encoded><![CDATA[<p>Yes, depending on what type of file and the type of data and the type of OS accessing the data performing this type of data manipulation can render the file useless. </p>
<p>There are plenty of articles throughout the rest of the site on using TrueCrypt as well. You are very correct in saying that if someone has data that they feel they need to hide or mask then they probably aren&#8217;t going to do something tedious like this, but this is not the point of the article.</p>
<p>Yes, EnCase is into the version 6 series which I use as well, in fact I use all versions of EnCase going back to 3. This method exists throughout.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JimBob</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-192</link>
		<dc:creator>JimBob</dc:creator>
		<pubDate>Wed, 24 Feb 2010 20:05:35 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-192</guid>
		<description>There is one thing I did not see mentioned (maybe I missed it). This makes that file unusable until you correct the bytes that you changed.  So, you need to mask the header to hide, but unmask to use, then mask again to hide.

I wonder why anyone would go through this hassle when you can hide data within a Truecrypt volume, or heck, even a hidden Truecrypt volume.  That is a much easier solution, and investigators cannot do anything about it without the password.

By the way, EnCase has progressed 2 major versions beyond that hacked version in your screen shots.</description>
		<content:encoded><![CDATA[<p>There is one thing I did not see mentioned (maybe I missed it). This makes that file unusable until you correct the bytes that you changed.  So, you need to mask the header to hide, but unmask to use, then mask again to hide.</p>
<p>I wonder why anyone would go through this hassle when you can hide data within a Truecrypt volume, or heck, even a hidden Truecrypt volume.  That is a much easier solution, and investigators cannot do anything about it without the password.</p>
<p>By the way, EnCase has progressed 2 major versions beyond that hacked version in your screen shots.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Yar (Admin)</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-163</link>
		<dc:creator>Yar (Admin)</dc:creator>
		<pubDate>Tue, 22 Dec 2009 05:52:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-163</guid>
		<description>This is a great response Chris and the reasons you have given are very solid. Thank you for commenting on this topic.</description>
		<content:encoded><![CDATA[<p>This is a great response Chris and the reasons you have given are very solid. Thank you for commenting on this topic.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chris Ford</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-162</link>
		<dc:creator>Chris Ford</dc:creator>
		<pubDate>Mon, 21 Dec 2009 22:05:23 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-162</guid>
		<description>Excalibur ii 1000, I&#039;ll answer...

For sensitive company information, we create a Truecrypt block volume on a device, create a hidden volume within that, with the datasets recorded being truecrypt containers with hidden volumes.

Being that we send analysis data to &quot;hostile&quot; countries (Such as China, Vietnam, America) where data interception by those governments is high - using this method to encrypt TB&#039;s of data on a HDD is valuable indeed.

We have, over the past 12 monhts, &quot;lost&quot; 30-35 disks in international mail-handling system - luckily, those who have stolen these will not recover anything!   This keeps our IP safe....

We aren&#039;t doing anything illegal - (except for Veitnam, where any disk encryption is illegal) but we&#039;ve never had any issues with &quot;lost&quot; disks there..</description>
		<content:encoded><![CDATA[<p>Excalibur ii 1000, I&#8217;ll answer&#8230;</p>
<p>For sensitive company information, we create a Truecrypt block volume on a device, create a hidden volume within that, with the datasets recorded being truecrypt containers with hidden volumes.</p>
<p>Being that we send analysis data to &#8220;hostile&#8221; countries (Such as China, Vietnam, America) where data interception by those governments is high &#8211; using this method to encrypt TB&#8217;s of data on a HDD is valuable indeed.</p>
<p>We have, over the past 12 monhts, &#8220;lost&#8221; 30-35 disks in international mail-handling system &#8211; luckily, those who have stolen these will not recover anything!   This keeps our IP safe&#8230;.</p>
<p>We aren&#8217;t doing anything illegal &#8211; (except for Veitnam, where any disk encryption is illegal) but we&#8217;ve never had any issues with &#8220;lost&#8221; disks there..</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob Zirnstein</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-156</link>
		<dc:creator>Rob Zirnstein</dc:creator>
		<pubDate>Wed, 18 Nov 2009 02:47:10 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-156</guid>
		<description>The best way to detect file types with high accuracy is to develop additional methods for creating comparable signatures/hashes of files and confirming the results with mini interpreters.  This is how we see past tricks like the simple addition of &quot;MZ&quot; at the beginning of a file.</description>
		<content:encoded><![CDATA[<p>The best way to detect file types with high accuracy is to develop additional methods for creating comparable signatures/hashes of files and confirming the results with mini interpreters.  This is how we see past tricks like the simple addition of &#8220;MZ&#8221; at the beginning of a file.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: excalibur ii 1000</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-154</link>
		<dc:creator>excalibur ii 1000</dc:creator>
		<pubDate>Fri, 13 Nov 2009 06:20:49 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-154</guid>
		<description>Now why would you want to do anything on this website unless you were a criminal!?

&lt;a href=&quot;http://minelabexcalibur.com/the-minelab-excalibur-ii-1000-and-the-excalibur-ii-800/&quot; rel=&quot;nofollow&quot;&gt;minelab excalibur 1000&lt;/a&gt;</description>
		<content:encoded><![CDATA[<p>Now why would you want to do anything on this website unless you were a criminal!?</p>
<p><a href="http://minelabexcalibur.com/the-minelab-excalibur-ii-1000-and-the-excalibur-ii-800/" rel="nofollow">minelab excalibur 1000</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Snake</title>
		<link>http://www.anti-forensics.com/beat-encase-file-signature-analysis-on-a-windows-system/comment-page-1#comment-150</link>
		<dc:creator>Snake</dc:creator>
		<pubDate>Wed, 16 Sep 2009 04:02:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.anti-forensics.com/?p=564#comment-150</guid>
		<description>I guess if you think about it, what else can encase do ya no?</description>
		<content:encoded><![CDATA[<p>I guess if you think about it, what else can encase do ya no?</p>
]]></content:encoded>
	</item>
</channel>
</rss>

