Hiding data in Btrfs file systems

Data hiding in file systems is a common form of anti-forensics, however, most research in this area has been conducted on common file systems such as FAT, NTFS, Ext, etc., and not lesser used file systems. This research focuses on data hiding in Btrfs file systems. While Btrfs is now the standard for openSUSE and Fedora Linux distributions forensic tools still provide little support for the file system. This paper proposes six new techniques for data hiding in the Btrfs file system and evaluates their effectiveness using the metrics of capacity, stability and detection difficulty.