Year: 2026
Type: article
Abstract: Data hiding in file systems is a common form of anti-forensics, however, most research in this area has been conducted on common file systems such as FAT, NTFS, Ext, etc., and not lesser used file systems. This research focuses on data hiding in Btrfs file systems. While Btrfs is now the standard for openSUSE and Fedora Linux distributions forensic tools still provide little support for the file system. This paper proposes six new techniques for data hiding in the Btrfs file system and evaluates their effectiveness using the metrics of capacity, stability and detection difficulty.
Authors: Fergus Toolan, Georgina Humphries
Institution: Norwegian Police University College
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Estimated APC paid: $3,100
OpenAlex ID: W7169674612