312-50 Question 149
Single answer▪ Hiding FilesDuring an internal security assessment, you are asked to demonstrate how an attacker could conceal a stolen archive on a Windows workstation without changing its apparent file type. You have a benign image file named "holiday.jpg" and a ZIP archive named "payroll.zip." You want the result to appear as a normal JPEG in Windows Explorer while actually containing the ZIP data so it can be extracted later with the appropriate tool. Which action best achieves this goal?
- A
Use the Windows copy command in binary mode to append the ZIP archive to the JPEG, for example: copy /b holiday.jpg + payroll.zip hidden.jpg
- B
Change the extension of payroll.zip to holiday.jpg so Windows treats the archive as a hidden image container
- C
Set the Hidden attribute on payroll.zip with attrib +h payroll.zip so the archive becomes embedded inside holiday.jpg
- D
Encrypt payroll.zip with EFS and then rename it to hidden.jpg so only authorized users can detect the embedded archive
Show answer and explanation
Correct answer: A
Explanation
The best answer is to append the ZIP archive to the JPEG in binary mode using the Windows copy command. This works because many file formats, including JPEG, can still render correctly even if extra data is placed after the formal end of the image data, while ZIP utilities may detect the ZIP structure later in the file. In CEH-style scenarios, this demonstrates a practical file-hiding technique that differs from simply marking a file as hidden or renaming its extension. Defenders should detect this by validating file signatures, checking for trailing data, and using forensic tools rather than trusting file extensions alone. Microsoft documents the behavior of the copy command and its /b binary option, and common DFIR best practices emphasize file signature analysis over extension-based identification.
- A. Correct.
Correct. Appending a ZIP archive to the end of a JPEG using the Windows copy command in binary mode is a classic file-hiding technique. JPEG decoders typically ignore trailing data after the valid image content, so the file still opens as an image in many viewers, while archive tools such as 7-Zip or WinZip may still detect and extract the appended ZIP data. This matches the scenario requirement of preserving the apparent file type while concealing additional data.
- B. Incorrect.
Incorrect. Simply renaming payroll.zip to .jpg does not embed the archive inside an image; it only changes the filename extension. The file contents remain a ZIP archive, and the mismatch between header/signature and extension is easy to detect. Many tools will fail to open it as a valid JPEG, and forensic inspection would quickly reveal the true file type.
- C. Incorrect.
Incorrect. The Hidden attribute only changes how the file is displayed in Windows; it does not combine files or conceal one file inside another. This is a common misconception because 'hidden' in Windows refers to visibility in the file system, not data embedding or steganographic concealment.
- D. Incorrect.
Incorrect. Encrypting a ZIP file with EFS protects access to the file, but it does not embed the ZIP into a JPEG. Renaming an EFS-encrypted ZIP to .jpg still leaves it as a ZIP-format file with a misleading extension. EFS is an access-control and encryption feature, not a file-hiding or data-appending mechanism.