ABSTRACT

The project proposes a scheme for the detection of watermarking present in any file and extraction of hidden contents present within it. Thus, our project can be used by forensic departments during their process of investigation or scanning of a series of suspected hard drives, to effectively determine the presence of any valuable information within those drives. The project is designed to detect the signature of the watermarking tool (HIDERMAN V3.0) in encrypted files. Extraction of the password and the message follows signature extraction. Logging the numerous VB6 object event reports, VB Intrinsics and Local API calls helped us to achieve the same. The tool employs a unique permutation algorithm on the password to encrypt the message and append it to the end of the file. It also uses random sequences to further abstract the permutation. It also limits the size of the truck file and embedded file by a threshold ratio. Thus on the successful completion of this project we have been able to reverse engineer an algorithm to successfully detect the use, and reverse the encryption done by one such tool.