How can I hide a file into the 63 sectors right after MBR space on the disk?

Question

0.00/5 (No votes)

See more:

Hi all,

As you (may) know there are 63 sectors after the MBR space on the hard disk. It's a potential place where people can hide some files or information. I am trying to test some forensic tools whether they can find the hidden file in that specific area. So, is there any suggestion regarding how I can hide an image file in that are?

Any help will be appreciated.

Lorderon

Posted 6-Sep-12 5:12am

LoRDeRoN

Add a Solution

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Bernhard Hiller · Answer 1 · 2012-09-07T00:04:00

Solution 3

I do not know a Windows tool for such a thing. But Linux/Unix offers the command "dd if=inputfile.jpg of=/dev/hda" for writing directly to a disk. Beware: you can destroy your system when you do not use it correctly!
See e.g. http://www.linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/[^] for some examples on its use, though your specific case is not shown.

Posted 7-Sep-12 0:04am

Bernhard Hiller

Comments

LoRDeRoN 7-Sep-12 11:59am

Hi Bernhard,

Thank you. You are right, I might use dd tool. As for the link, I think it's very helpful anyway. I'll see if I can do what I need.

Best,
Lorderon

Super Lloyd · Answer 2 · 2012-09-06T05:38:00

Solution 1

You can find some ideas by using Google!
Here is an example query[^]! ;)

It yielded this interesting looking link on CodeProject!!
Undelete a file in NTFS[^]

Posted 6-Sep-12 5:38am

Super Lloyd

Comments

LoRDeRoN 6-Sep-12 11:42am

Thanks for your post, however I'm not looking for a way to recover a file from the disk. I am trying to hide a file into the disk and specifically to just right after the MBR space. Hope it's clear.

Super Lloyd · Answer 3 · 2012-09-06T05:54:00

Solution 2

Well I didn't study the article closely, but I'll bet it contains relevant information!
How about this link[^] (found in the article)!?

Posted 6-Sep-12 5:54am

Super Lloyd

Comments

LoRDeRoN 6-Sep-12 14:31pm

It doesn't have what I need. Thank you though.