312-49V11: Computer Hacking Forensic InvestigatorDemo

Slacker is the Metasploit Anti-Forensics tool designed to hide data in the slack space of files on FAT or NTFS file systems. Slack space is the unused portion of a disk cluster left over after a file's actual data ends but before the end of the allocated cluster — space that is allocated to a file yet unused by it, and which often still contains residual data from files that were previously deleted. Slacker exploits this by splitting a hidden file into fragments and writing them into the slack space of multiple other files that are unlikely to change, encrypting the associated metadata so forensic tools cannot easily detect the hidden content. This differs from RuneFS (which stores data in disk bad blocks), FragFS (which hides data in NTFS MFT entries), and Waffen FS (which stores data in the ext3 journal file).