Planting Evidence in File Slack

In this lab, you create a test drive by planting evidence in the file slack space on a USB drive. Then, you use Hex Workshop (which you should have downloaded from www.hexworkshop.com) to verify that the drive contains evidence.

1. Wipe and format as FAT32, a small flash drive. Create a document in Word and type the sentence Testing for string Millennium. Save the document as a Word 97 3003 document on the formatted flash drive. You dont have Microsoft Word in your VM, so create this document on your main desktop. When you open your VM, make sure it recognizes the flash drive.

Next, you use Hex Workshop to hide information in the file slack space:

1. Working in your virtual system, download and install Hex Workshop. Start the program.

2. In Hex Workshop, click File, Open from the menu. (Note: When you see the UAC message box, click Yes.) Make sure the flash drive is selected, and then click OK.

3. Click File, Open from the menu. Navigate to and double-click on the name of the Word document you created earlier. Scroll down in the Data Visualizer frame until you see Testing for string Millennium.

4. Scroll back up to the top and try finding the string another way. Click Edit, Find from the menu. In the Find dialog box, make sure Test String is selected in the Type list box. Type Millennium in the Value text box. Under Options, check the Find All Instances and Match Case and click the All option. Click OK. (If Hex Workshop doesn't find Millennium the first time, repeat this step. Take a screen shot of Hex Workshop showing you located the text string and upload it with this assignment.

5. Scroll down about four lines below Testing for string Millennium and type Murder She Wrote, then click File, Save as and name the file something different.

6. You now have two files on the flash drive. Open the new file. What did you expect to see? You have hidden data in the slack space of a MS-Word file.

7. Exit Hex Workshop.