Posts Tagged ‘hex editing’

Beat EnCase File Signature Analysis on a Windows System

EnCase - WinRAR Archives

Beat EnCase File Signature Analysis on a Windows System

September 13, 2009 |  by  |  EnCase, Hex Editing  |  , , , , ,  |  9 Comments

Use a hex editor to modify the file signature of a WinRAR archive to that of an executable file to beat the EnCase forensic software's file signature analysis.

Read More

Modify TrueCrypt Encryption Boot Loader Strings

March 1, 2009 |  by  |  Encryption, Featured Articles, Hex Editing  |  , , ,  |  17 Comments

In a previous post I mentioned that TrueCrypt leaves behind a string in its boot loader (that identifies it as a TrueCrypt boot loader) when using the full disk encryption feature. As you can see in the screenshot below I have modified the original "TrueCrypt Boot Loader" string to read "Windows Boot Loader."

Read More