Bit-Shifting
1
Computer users have developed the skill of programming in the computer
manufacturer’s assembly language and learned how to create a low-level
encryption program that changes the order of binary data (bits), making the
altered data unreadable when accessed with a text editor or word processor.
These programs rearrange bits for each byte (8 bits) in a file. To secure a file
containing sensitive or incriminating information, these users run a program to
scramble the bits. To access the file, they run another program that restores the
scrambled bits to their original order. Some of these programs are still used
today and can make it difficult for investigators to analyze data on a suspect
drive.
A related, and well-known, technique for hiding data is shifting bit patterns to alter
the byte values of data. Bit-shifting changes data from readable code to data that
looks like binary executable code. Hex Workshop includes a feature for shifting
bits and altering byte patterns of entire files or specified data.
To shift bits in a text file, follow these steps:
1. Start Notepad, and in a text document, type your name and/or a phrase that you will
remember ex: "Test file for testing bit-shfiting"
2. Save the file as Bitshift.txt to your desktop, and exit Notepad.
3. Start Hex Workshop by clicking the icon on your desktop. Click File,
Open from the menu. Navigate to your desktop and then double-click
Bitshift.txt.
4. To set up Hex Workshop for bit-shifting, click Options, Toolbars from the menu.
5. In the Customize dialog box, click the Data Operations check box, and then click OK.
You'll notice many different kinds of bit shifting operands. Today we'll only use the
simple shift left and right operands but feel free to explore the others.
6. Click the Shift Left button on the Data Operations toolbar.
The Shift Left Operation dialog box opens. This is where you specify how you want to
treat the data, the ordering scheme to use for bytes, and whether you shift bits for
Bit-Shifting
2
selected text or the entire file.
Generally, we can leave this as
the default, but we must
remember what it was.
7. Click OK to accept the default
settings and shift the bits in
Bitshift.txt to the left.
8. Save the file as Bitshift_left.txt
to your desktop.
9. Open the file we just created,
Bitshift_left.txt and notice it is no
longer the message we created.
The bit shift left has made the message unreadable.
10. Back in Hex Workshop, click the shift right icon in the toolbar and make sure the data
format and byte ordering are the same as before.
11. Save as Bitshift_right.txt to your desktop. Open Bitshiftright.txt to see the message
has been recovered.