Risk and Opportunity

I stumbled onto a pair of programs called seejunk.exe and prune.exe this
past week.  It seems that files are stored on disk media in fixed units
called clusters.  Your file size is usually not an integral multiple of
disk clusters in size, so the ends of your file is followed by random
data to fill up that last cluster.  Random is a bad choice of words
though.  I suppose each system is different, but under DOS, the extra
fill data is a copy of a piece of whatever you had in memory at the time
your system wrote the file.  You could have information written to disk
that you do not wish to have there, and seejunk.exe will show it to you
... and anyone else.  prune.exe is the solution offered.  Using this
program, I wrote "This space intentionally left blank " repeating in
the 5K of space sitting at the end of the doc file for these two programs.

 That was the risk and the fix available.  There is also an opportunity
here.  Encrypted information could be stored at the end of your files.
In other words this is an opportunity for steganography.  You would
have to be careful though; any disk operation involving that file could
corrupt your encrypted data.

 I don't have full access to the internet.  If someone finds these
programs on the internet, can they post the location here.  If the
files aren't on the internet, I can email them to anyone that wants
to post them to the cypherpunk ftp site.

Peter Baumbach
baumbach@atmel.com

P. Baumbach wrote -

>   I stumbled onto a pair of programs called seejunk.exe and prune.exe this
> past week.  It seems that files are stored on disk media in fixed units
> called clusters.  Your file size is usually not an integral multiple of
> disk clusters in size, so the ends of your file is followed by random
> data to fill up that last cluster.  Random is a bad choice of words
> though.  I suppose each system is different, but under DOS, the extra
> fill data is a copy of a piece of whatever you had in memory at the time
> your system wrote the file.  You could have information written to disk
> that you do not wish to have there, and seejunk.exe will show it to you
> ... and anyone else.  prune.exe is the solution offered.  Using this
> program, I wrote "This space intentionally left blank " repeating in
> the 5K of space sitting at the end of the doc file for these two programs.

These two nifty programs have been around for a while -- they are considered
"must haves" in any competent hack's tool kit. .-)

They are produced by a company called Sydex Software (support bbs at
503.683.1385) and prune.exe is especially useful to clear out buffer 
garbage between the <eof> marker and the sector boundary. 

Most folks know of their more popular programs, AnaDisk (a really
good floppy disk analytical tool) and TeleDisk (another nifty tool to
compress an entire diskette and its contents into a single, compressed
file for transport).

Cheers.