1
00:00:00,630 --> 00:00:07,180
In the previous videos, we have seen how we can use different tools and techniques for steganography.

2
00:00:07,830 --> 00:00:16,350
Now, as a security expert, how would you detect some hidden files, already hidden files in a particular

3
00:00:16,350 --> 00:00:18,270
folder or a particular drug?

4
00:00:18,870 --> 00:00:24,450
So in this lesson, we will see a tool called expired IDS.

5
00:00:24,450 --> 00:00:27,230
Spy UDIA stands for alternate data streams.

6
00:00:27,760 --> 00:00:28,050
Right.

7
00:00:28,300 --> 00:00:33,330
This tool will help us to detect whodunit files and also help us to delete them.

8
00:00:33,750 --> 00:00:33,990
Right.

9
00:00:34,380 --> 00:00:35,990
So let's see how it works.

10
00:00:38,170 --> 00:00:40,660
See, this is how it looks.

11
00:00:41,690 --> 00:00:49,380
OK, nothing special, just the basic options like Greek skin, OK, for windows baseballer only full

12
00:00:49,390 --> 00:00:53,320
skin, skin, only a particular folder's, etc..

13
00:00:53,980 --> 00:00:56,090
Now we will go with full skin.

14
00:00:56,790 --> 00:01:02,530
OK, so it will going to scan all NTFS drives to start scanning.

15
00:01:02,530 --> 00:01:07,390
Simply click on this button, which is scanned the system for alternate datastream.

16
00:01:08,080 --> 00:01:08,420
Right.

17
00:01:09,970 --> 00:01:17,290
See, it has detected some of the files that we have hidden previously right now.

18
00:01:17,560 --> 00:01:24,160
Then you can wait for the scan to complete, but it will actually going to take a lot of time, right?

19
00:01:24,550 --> 00:01:29,080
Because it will going to scan each and every file and folder in your system.

20
00:01:29,890 --> 00:01:32,620
So for now, let's scan.

21
00:01:34,690 --> 00:01:42,730
OK, and to delete hidden files, simply check on the files, which you want to delete and click here,

22
00:01:42,910 --> 00:01:44,710
remove selected streams.

23
00:01:45,700 --> 00:01:49,220
OK, they will be deleted permanently.

24
00:01:49,360 --> 00:01:51,790
Yes, right.

25
00:01:52,180 --> 00:01:54,010
So this is how it is.

26
00:01:54,010 --> 00:01:55,210
A spy works.