CN104036201A - Application-layer file hiding method on Windows operating system - Google Patents

Abstract

The invention discloses an application-layer file hiding method on the Windows operating system and belongs to the field of information security. The method is on the basis of an application layer, the system kernel is not involved, and only a client program runs in a master of a file to be hidden. Two modules, namely a file hiding module and a file reading module, are adopted. The file hiding module is used for hiding files in a file storage medium on the basis of an FAT 32 or NTFS file system, the hidden files are independent to the operating system and system partitions. The file reading module is used for recovering the hidden files to the operating system and displaying the files. By the aid of the method, lightweight files can be hidden on the Windows platform, operability is high, and security of information can be improved greatly, and integrity of the information can be protected.

Description

A Method for Hiding Application Layer Files under Windows Operating System

technical field

The invention belongs to the field of information security, and in particular relates to an application layer file hiding method under the Windows operating system. It mainly provides a lightweight file hiding under the Windows operating system, so that the files have higher security and data integrity. The technologies involved mainly include: directly operating the disk sector under the Windows platform to hide and read files.

Background technique

With the development of the Internet and the increasing popularity of computers, the information transmitted on the network has shown an explosive growth. At the same time, the number of computer viruses is also increasing day by day, and the harm is also increasing. It is a part of the daily life of computer users, but the rampant hackers on the Internet further threaten the security and normal use of computer user data. Currently, there are many examples of losses caused by the theft of files on computers.

For the protection of information, the traditional method is to use encryption technology, that is, to continue to encrypt files. The encryption technology has nothing to do with the specific operating system, and it is decrypted when it is used, so as to achieve the purpose of protecting files. However, encryption technology has certain limitations. Its confidentiality depends on the encryption algorithm and key strength used, and once the key is forgotten, it is very difficult to recover. Moreover, encryption cannot prevent files from being stolen. Once stolen, there is a risk of being decrypted.

There is another way of file hiding based on the characteristics of the file system itself. This way is mainly related to the file system, rather than depending on the running operating system. For the NTFS file system, the patent "File Hiding Method Based on NTFS Disk File System Structure (Application No.: 03118546.0)" proposes a method for hiding files through data streams. However, this method needs to copy the file to the stream, and it is limited to the NTFS file system, which has relatively large limitations.

A method of directly deleting the index record corresponding to the file to be hidden in the file index mentioned in the patent "Lightweight file hiding method under NTFS file system (application number: CN200910045412.6)", which can hide any file, and the efficiency Not affected by file size. However, this method does not consider the situation of data being overwritten. When the file record is deleted, the corresponding bit of the $Bitmap metafile will be marked as unused, and future files will overwrite the previously hidden data.

The patent "A method for protecting data by using disk hidden sectors under Windows system (application number: 02155511.7)" hides files through hard disk HPA. This method realizes file hiding by creating disk HPA and managing HPA. However, this method relies heavily on the HPA system, and may need to modify existing partitions, which is inconvenient to operate.

Contents of the invention

For above-mentioned shortcoming of prior art, the object of the present invention is to propose a kind of file hiding method based on Windows operating system, realize the hiding of specified file by utilizing the disk partition gap and disk reserved sector, solve the data file security and integrity issues.

In order to solve the above problems, the present invention adopts the following technical solutions:

An application layer file hiding method under the Windows operating system, including a data hiding method and a data reading method for hiding data recovery, wherein the specific steps of the file hiding method are:

Step a1, traversing the disk partition table under the Windows operating system, finding the start sector number and the end sector number of each partition, and finding the sector number of the last sector of the disk.

Step a2, according to the partition information found in the first step, calculate the available partition gap and the last available sector.

Step a3, organizing the obtained fragmented available sectors to form a complete available space. Step a4. Initialize the space obtained in the third step, set a corresponding data mechanism, and record relevant information of the small file system.

In step a5, the file to be hidden is compressed and encrypted according to corresponding rules, and then stored in a corresponding space, and relevant information of the file is recorded.

The data reading method for hidden data recovery specifically includes the following steps:

Step b1: traverse the disk partition table under the Windows operating system, find the start sector number and end sector number of each partition, and find the sector number of the last sector of the disk.

Step b2: According to the partition information found in the first step, calculate the sector number where the system head of the small file system is located.

Step b3: According to the sector number of the small file system obtained in the second step, read the relevant information to obtain the relevant information of the files in the space.

Step b4: According to the file information obtained in the third step, read the specified file, decrypt and decompress it, and save it in the operating system.

Furthermore, all operations are completed under the application layer without involving the kernel operation of the system.

Furthermore, the hiding of files is to separate the files originally belonging to the Windows operating system from the operating system and the system partition, and save the file information to other places, and the data in the files are also stored in the hard disk.

Furthermore, the core of file hiding and file reading is the use of partition gaps and reserved sectors on the disk, in which the distribution of the available space in this small file system and the saved file information are stored, which can be stored from the storage Read data directly on the media.

Furthermore, after the operating system is destroyed or reinstalled and the partition is reformatted, as long as there is no repartitioning, the relevant information in this small file system will not be destroyed, and will still be stored in the disk, and can still be intact through the client program. to read saved files.

Furthermore, the idea of hiding files in this patent is to achieve the purpose of hiding files by using the disk partition gap and reserved sectors without destroying the existing operating system and file system. Both hiding and reading are through dedicated The client completes the operation, so as to achieve the idea of file hiding.

Compared with the prior art, this method has the following advantages:

The hidden file operation has nothing to do with the operating system. Even if the system is reinstalled or the partition is formatted, as long as the partition is not adjusted, the hidden file will not be overwritten, which can ensure the integrity of the file to the greatest extent.

The operation of hiding files has nothing to do with the file system, no matter whether the file format of the partition is NTFS or FAT32, it will not affect the hiding of files.

Hidden files are relatively independent of the operating system. Except for using a dedicated client program, there is no other way to discover the existence of hidden files, let alone obtain compressed and encrypted files. Greatly improved the security of hidden files.

Description of drawings

Figure 1 is a flowchart of file hiding;

Figure 2 is a flow chart of file reading.

Detailed ways

The method will be further described below in conjunction with the accompanying drawings and specific embodiments.

The application layer file hiding method under Windows is divided into two modules, a data hiding module and a data reading module.

1. The specific operation steps of the data hiding module are as follows:

[1]: Traverse the disk partition table under the Windows operating system, find the start sector number and end sector number of each partition, and calculate the sector number of the end sector (reserved sector sector) of the disk by calculating the total number of bytes on the disk.

[2]: According to the partition information found in the first step and the sector information at the end of the disk, calculate the sector information from the end position of each partition to the start position of the next partition, and the sector information from the end position of the last partition to the end of the disk The sector information of the program can be used to obtain the partition gap and the available sector information at the end.

[3] : The fragmented available sectors obtained by the organization are mapped and managed to form a logically continuous and complete available space.

[4]: Initialize the space obtained in the third step, set the corresponding data organization, and record the available space, free space, file distribution and other related information of the small file system designed in this scheme.

[5]: Compress and encrypt the files to be hidden in the corresponding free space in reverse order, record the file name, size, location and other information in the file system header, and modify the number of available sectors, number of files and other information at the same time .

2. The specific steps of the data reading method are:

[1]: Traverse the disk partition table under the Windows operating system, find the start sector number and end sector number of each partition, and obtain the sector number of the end sector of the disk by calculating the total bytes of the disk.

[2]: According to the partition information found in the first step, the sector number of the sector at the end of the disk is obtained. According to the small file system designed in this scheme, the sector at the end of the disk is where the system head of the small file system designed in this scheme is located. sector.

[3]: According to the sector number of the small file system obtained in the second step, read the relevant information of the file system, and obtain the available sectors, files and other related information in the space.

[4] : According to the file information obtained in the third step, read the specified file, and then save it to the operating system after decompressing through decryption.

Claims (3)

1. the application layer file hiding method under Windows operating system, is characterized in that, the method for reading data that comprises data-hiding method and recover for hiding data, and wherein, the concrete steps of described file hiding method are:

Step a1: the disk partition table under traversal Windows operating system, find the start sector number of each subregion and finish sector number, find the sector number of sector, disk end;

Step a2: the partition information finding according to step a1, calculates utilizable subregion gap and available sector, end;

Step a3: scattered the utilized sector that tissue gets, forms complete a utilized space;

Step a4: initialization is carried out in the space obtaining in step a3, corresponding data structures is set, the relevant information of minute book small files system;

Step a5: file that will be hiding is saved in the middle of corresponding space after by corresponding regular compress-encrypt, log file relevant information;

The concrete steps of method for reading data are:

Step b1: the disk partition table under traversal Windows operating system, find the start sector number of each subregion and finish sector number, find the sector number of sector, disk end;

Step b2: the partition information finding according to step b1, calculates the sector number at the system head place of the small files system of this programme design;

Step b3: according to the sector number at this small files system place obtaining in step b2, read relevant information, obtain the relevant information of the file in space;

Step b4: according to the fileinfo obtaining in step b3, specified file is read, deciphering is saved in the middle of operating system after decompressing.

2. according to the application layer file hiding method below a kind of Windows operating system described in claim 1, it is characterized in that: all operations are all to complete under application layer, do not relate to the kernel operations of system.

3. according to the application layer file hiding method below a kind of Windows operating system described in claim 1, it is characterized in that: adopt disk read-write technology, by the direct control to sector, originally the file that belongs to Windows operating system is independent of to operating system and system partitioning is stored in other place, data in its file remain in hard disk, realize hiding of file.