Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Would malware be able to hide itself in the controller somehow or otherwise be able to effectively hide files itself from both windows and Linux?

share|improve this question
add comment

marked as duplicate by Adnan, Ladadadada, Lucas Kauffman, TildalWave, Terry Chia Nov 5 '13 at 11:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 2 down vote accepted

Short answer is no. Both Windows and Linux offers direct ways to hide file from traditional directory listings:

  • On Windows, you can add "Hidden file" property to a file,
  • On Linux, the file is considered hidden if the name begins with a dot (.). So, would have a file whose name begins with a dot and with 'hiden' attribute set, it would be invisible to both Windows and Linux standard directory listings and default file browser navigation.

Moreover, a malware could also use more advanced tricks, but this would be more OS dependant. For instance on Windows some malware are known to store data in user's files metadata, a functionality offered by Windows allowing to associate a potentially large amount of data to a file: this data avoid to create any new file, is accessible under Windows, and as far as know is not visible under Linux (Linux only show an inconsistency between file space actually used by the file ("du -sh") and remaining free space ("df -h") in case of large data stored this way).

This is just an example, usually malware can be quite inventive to hide themselves...

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.