{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,10,30]],"date-time":"2024-10-30T22:01:06Z","timestamp":1730325666659,"version":"3.28.0"},"publisher-location":"New York, NY, USA","reference-count":23,"publisher":"ACM","funder":[{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["13N15297"],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100008530","name":"European Regional Development Fund","doi-asserted-by":"publisher","award":["ZS\/2018\/12\/96222"],"id":[{"id":"10.13039\/501100008530","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Bundesministerium f\u00fcr Wirtschaft und Technologie","award":["1501589A, 1501600B"]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,6,23]]},"DOI":"10.1145\/3531536.3532965","type":"proceedings-article","created":{"date-parts":[[2022,6,23]],"date-time":"2022-06-23T18:18:44Z","timestamp":1656008324000},"page":"107-112","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Hidden in Plain Sight - Persistent Alternative Mass Storage Data Streams as a Means for Data Hiding With the Help of UEFI NVRAM and Implications for IT Forensics"],"prefix":"10.1145","author":[{"given":"Stefan","family":"Kiltz","sequence":"first","affiliation":[{"name":"Otto-von-Guericke University, Magdeburg, Germany"}]},{"given":"Robert","family":"Altschaffel","sequence":"additional","affiliation":[{"name":"Otto-von-Guericke University, Magdeburg, Germany"}]},{"given":"Jana","family":"Dittmann","sequence":"additional","affiliation":[{"name":"Otto-von-Guericke University, Magdeburg, Germany"}]}],"member":"320","published-online":{"date-parts":[[2022,6,23]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Retrieved","author":"Leibowitz Michael","year":"2019","unstructured":"Michael Leibowitz and Topher Timzen . 2019 . EDR is coming, hide your sh*t (August 2019) . Retrieved February 24, 2022 from https:\/\/media.defcon.org\/DEF%20CON%2027\/DEF%20CON%2027%20presentations\/DEFCON-27-Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht.pdf Michael Leibowitz and Topher Timzen. 2019. EDR is coming, hide your sh*t (August 2019). Retrieved February 24, 2022 from https:\/\/media.defcon.org\/DEF%20CON%2027\/DEF%20CON%2027%20presentations\/DEFCON-27-Michael-Leibowitz-and-Topher-Timzen-EDR-Is-Coming-Hide-Yo-Sht.pdf"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470069"},{"key":"e_1_3_2_1_3_1","article-title":"Overview: Main Fundamentals for Steganography","volume":"2","author":"Zaidoon Ani Kh.","year":"2010","unstructured":"AL- Ani Kh. Zaidoon and A. A. Zaidan and B. B. Zaidan and Hamdan. O. Alanazi . 2010 . Overview: Main Fundamentals for Steganography . Journal of computing 2 , 3, (March 2010), ISSN 2151--9617 Retrieved February 24, 2022 from https:\/\/arxiv.org\/pdf\/1003.4086 AL-Ani Kh. Zaidoon and A. A. Zaidan and B. B. Zaidan and Hamdan.O. Alanazi. 2010. Overview: Main Fundamentals for Steganography. Journal of computing 2, 3, (March 2010), ISSN 2151--9617 Retrieved February 24, 2022 from https:\/\/arxiv.org\/pdf\/1003.4086","journal-title":"Journal of computing"},{"key":"e_1_3_2_1_4_1","volume-title":"Retrieved","author":"Berkman A.","year":"2013","unstructured":"A. Berkman . 2013 . Hiding Data in Hard-Drive's Service Areas (February 2013) . Retrieved February 24, 2022 from https:\/\/dl.packetstormsecurity.net\/papers\/general\/SA-cover.pdf A. Berkman. 2013. Hiding Data in Hard-Drive's Service Areas (February 2013). Retrieved February 24, 2022 from https:\/\/dl.packetstormsecurity.net\/papers\/general\/SA-cover.pdf"},{"key":"e_1_3_2_1_5_1","volume-title":"Retrieved","author":"Domburg J.","year":"2013","unstructured":"J. Domburg . 2013 . Sprites mods Hard disk hacking (2013) . Retrieved February 24, 2022 from http:\/\/spritesmods.com\/?art=hddhack J. Domburg. 2013. Sprites mods Hard disk hacking (2013). Retrieved February 24, 2022 from http:\/\/spritesmods.com\/?art=hddhack"},{"key":"e_1_3_2_1_6_1","volume-title":"Retrieved","author":"Kallenberg Corey","year":"2015","unstructured":"Corey Kallenberg , Xeno Kova 2015 . How Many Million BIOSes Would you Like to Infect? (March 2015) . Retrieved February 24, 2022 from https:\/\/legbacore.com\/Research_files\/HowManyMillionBIOSWouldYouLikeToInfect_Full2.pdf Corey Kallenberg, Xeno Kova 2015. How Many Million BIOSes Would you Like to Infect? (March 2015). Retrieved February 24, 2022 from https:\/\/legbacore.com\/Research_files\/HowManyMillionBIOSWouldYouLikeToInfect_Full2.pdf"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.08.002"},{"key":"e_1_3_2_1_8_1","volume-title":"Proceedings of the 1st Digital Forensic Research Workshop (DFRWS), August 7- 8","author":"Palmer G.","year":"2001","unstructured":"G. Palmer . 2001 . A road map for digital forensic research . In Proceedings of the 1st Digital Forensic Research Workshop (DFRWS), August 7- 8 , 2001, Utica, New York, USA, 27--30 G. Palmer. 2001. A road map for digital forensic research. In Proceedings of the 1st Digital Forensic Research Workshop (DFRWS), August 7- 8, 2001, Utica, New York, USA, 27--30"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460412"},{"key":"e_1_3_2_1_10_1","volume-title":"Digital evidence and computer crime: forensic science, computers and the Internet","author":"Casey Eoghan","unstructured":"Eoghan Casey . 2011. Digital evidence and computer crime: forensic science, computers and the Internet ( 3 rd ed.). Elsevier Inc . ISBN 978-0--12--374268--1 Eoghan Casey. 2011. Digital evidence and computer crime: forensic science, computers and the Internet (3rd ed.). Elsevier Inc. ISBN 978-0--12--374268--1","edition":"3"},{"key":"e_1_3_2_1_11_1","volume-title":"Retrieved","author":"IEEE","year":"1994","unstructured":"IEEE 1994 . IEEE Standard for Boot (Initialization Configuration) Firmware: Core Requirements and Practices (1994) . Retrieved February 24, 2022 from https:\/\/www.openfirmware.info\/data\/docs\/of1275.pdf IEEE 1994. IEEE Standard for Boot (Initialization Configuration) Firmware: Core Requirements and Practices (1994). Retrieved February 24, 2022 from https:\/\/www.openfirmware.info\/data\/docs\/of1275.pdf"},{"key":"e_1_3_2_1_12_1","volume-title":"Retrieved","author":"Michael Niehaus","year":"2019","unstructured":"Niehaus Michael . 2019 . Working with UEFI variables from PowerShell (October 2019) . Retrieved February 24, 2022 from https:\/\/oofhours.com\/2019\/10\/05\/working-with-uefi-variables-from-powershell\/ Niehaus Michael. 2019. Working with UEFI variables from PowerShell (October 2019). Retrieved February 24, 2022 from https:\/\/oofhours.com\/2019\/10\/05\/working-with-uefi-variables-from-powershell\/"},{"key":"e_1_3_2_1_13_1","volume-title":"Retrieved","author":"Association of Chief Police Officers.","year":"2011","unstructured":"Association of Chief Police Officers. 2011 . Good Practice Guide for Computer-Based Electronic Evidence (October 2011) . Retrieved February 24, 2022 from https:\/\/www.7safe.com\/docs\/default-source\/default-document-library\/acpo_guidelines_computer_evidence_v4_web.pdf (24\/02\/2022) Association of Chief Police Officers. 2011. Good Practice Guide for Computer-Based Electronic Evidence (October 2011). Retrieved February 24, 2022 from https:\/\/www.7safe.com\/docs\/default-source\/default-document-library\/acpo_guidelines_computer_evidence_v4_web.pdf (24\/02\/2022)"},{"key":"e_1_3_2_1_14_1","volume-title":"Retrieved","author":"Scientific Working Group on Digital Evidence.","year":"2014","unstructured":"Scientific Working Group on Digital Evidence. 2014 . SWEDGE UEFI and its Effects on Digital Forensics Imaging (February 2014) . Retrieved February 24, 2022 from https:\/\/www.irisinvestigations.com\/wp-content\/uploads\/2019\/05\/SWGDE-UEFI-and-its-Effect-on-Digital-Forensics-Imaging-020614.pdf Scientific Working Group on Digital Evidence. 2014. SWEDGE UEFI and its Effects on Digital Forensics Imaging (February 2014). Retrieved February 24, 2022 from https:\/\/www.irisinvestigations.com\/wp-content\/uploads\/2019\/05\/SWGDE-UEFI-and-its-Effect-on-Digital-Forensics-Imaging-020614.pdf"},{"volume-title":"Computer Architecture and Organization - Fundamentals and Architecture Security","author":"Wang Paul Shuangbao","key":"e_1_3_2_1_16_1","unstructured":"Paul Shuangbao Wang . 2021. Computer Architecture and Organization - Fundamentals and Architecture Security , Springer , ISBN 978--981--16--5661--3 Paul Shuangbao Wang. 2021. Computer Architecture and Organization - Fundamentals and Architecture Security, Springer, ISBN 978--981--16--5661--3"},{"key":"e_1_3_2_1_17_1","volume-title":"Retrieved","author":"Forum UEFI","year":"2020","unstructured":"UEFI Forum . 2020 . UEFI Specification Version 2.8 (Errata B) (released June 2020) . Retrieved February 24, 2022 from https:\/\/uefi.org\/sites\/default\/files\/resources\/UEFI%20Spec%202.8B%20May%202020.pdf UEFI Forum. 2020. UEFI Specification Version 2.8 (Errata B) (released June 2020). Retrieved February 24, 2022 from https:\/\/uefi.org\/sites\/default\/files\/resources\/UEFI%20Spec%202.8B%20May%202020.pdf"},{"key":"e_1_3_2_1_18_1","volume-title":"Retrieved","author":"Garrett Matthew","year":"2013","unstructured":"Matthew Garrett . 2013 . Dealing with UEFI non-volatile memory quirks (June 2013) . Retrieved February 24, 2022 from https:\/\/mjg59.dreamwidth.org\/25091.html Matthew Garrett. 2013. Dealing with UEFI non-volatile memory quirks (June 2013). Retrieved February 24, 2022 from https:\/\/mjg59.dreamwidth.org\/25091.html"},{"key":"e_1_3_2_1_19_1","first-page":"1","article-title":"Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery","volume":"5","author":"Bell Graeme B.","year":"2010","unstructured":"Graeme B. Bell and Richard Boddington . 2010 . Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery ? Journal of Digital Forensics, Security and Law 5 , 3 (2010), 1 -- 20 Graeme B. Bell and Richard Boddington. 2010. Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery? Journal of Digital Forensics, Security and Law 5, 3 (2010), 1--20","journal-title":"Journal of Digital Forensics, Security and Law"},{"key":"e_1_3_2_1_20_1","volume-title":"Retrieved","author":"Shipley T. G.","year":"2022","unstructured":"T. G. Shipley and B. Door . 2012. Forensic Imaging of Hard Disk Drives - What we thought we knew (January 2012) . Retrieved February 24, 2022 from http:\/\/national-forensic-data-recovery-training-center.net\/app\/download\/5889763504\/Forensic+Imaging+of+hard+drives+and+what+we+thought+we+knew+20120126+v1.pdf T. G. Shipley and B. Door. 2012. Forensic Imaging of Hard Disk Drives - What we thought we knew (January 2012). Retrieved February 24, 2022 from http:\/\/national-forensic-data-recovery-training-center.net\/app\/download\/5889763504\/Forensic+Imaging+of+hard+drives+and+what+we+thought+we+knew+20120126+v1.pdf"},{"volume-title":"Retrieved","year":"2021","key":"e_1_3_2_1_21_1","unstructured":"Stackexchange. 2021 . Best way to remove bytes from the start of a file? (March 2021) . Retrieved February 24, 2022 from https:\/\/unix.stackexchange.com\/questions\/6852\/best-way-to-remove-bytes-from-the-start-of-a-file Stackexchange. 2021. Best way to remove bytes from the start of a file? (March 2021). Retrieved February 24, 2022 from https:\/\/unix.stackexchange.com\/questions\/6852\/best-way-to-remove-bytes-from-the-start-of-a-file"},{"key":"e_1_3_2_1_22_1","volume-title":"Retrieved","author":"Kendall Kriss","year":"2007","unstructured":"Kriss Kendall and Jesse Kornblum . 2007 . Foremost (2007) . Retrieved February 24, 2022 from http:\/\/foremost.sourceforge.net\/ Kriss Kendall and Jesse Kornblum. 2007. Foremost (2007). Retrieved February 24, 2022 from http:\/\/foremost.sourceforge.net\/"},{"key":"e_1_3_2_1_23_1","volume-title":"Retrieved","author":"Jackson T.","year":"2021","unstructured":"T. Jackson . 2021 . GospelRoom: Data Storage in UEFI NVRAM Variables (December 2021) . Retrieved February 24, 2022 from https:\/\/gist.github.com\/jthuraisamy\/e602d5d870230df3ce00178001f9ac16 T. Jackson. 2021. GospelRoom: Data Storage in UEFI NVRAM Variables (December 2021). Retrieved February 24, 2022 from https:\/\/gist.github.com\/jthuraisamy\/e602d5d870230df3ce00178001f9ac16"},{"volume-title":"Retrieved","year":"2017","key":"e_1_3_2_1_24_1","unstructured":"Winbond. 2017 . 3V 64M-BIT Serial Flash Memory With Dual\/Quad SPI & QPI (July 2017) . Retrieved February 24, 2022 from https:\/\/www.winbond.com\/resource-files\/w25q64fv%20revs%2007182017.pdf Winbond. 2017. 3V 64M-BIT Serial Flash Memory With Dual\/Quad SPI & QPI (July 2017). Retrieved February 24, 2022 from https:\/\/www.winbond.com\/resource-files\/w25q64fv%20revs%2007182017.pdf"}],"event":{"name":"IH&MMSec '22: ACM Workshop on Information Hiding and Multimedia Security","sponsor":["SIGMM ACM Special Interest Group on Multimedia"],"location":"Santa Barbara CA USA","acronym":"IH&MMSec '22"},"container-title":["Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3531536.3532965","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,6,23]],"date-time":"2023-06-23T07:27:28Z","timestamp":1687505248000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3531536.3532965"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,23]]},"references-count":23,"alternative-id":["10.1145\/3531536.3532965","10.1145\/3531536"],"URL":"https:\/\/doi.org\/10.1145\/3531536.3532965","relation":{},"subject":[],"published":{"date-parts":[[2022,6,23]]},"assertion":[{"value":"2022-06-23","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}