Data hiding in symbolic link slack space

Abstract

Recent research has begun to focus on data hiding in file systems, however, much of this is focused on individual file systems such as ext, NTFS and XFS. This paper examines an exploitation of symbolic link storage methods to manufacture slack space which can be used for hiding information in file systems. Many modern file systems, including ext, XFS, BtrFS, HFS+, APFS and NTFS support symbolic links at the file system level. This paper investigates these structures in the various file systems and determines if the symbolic links can be used to create slack space, and if so determines their effectiveness in hiding data from users, system administrators and forensic analysts.