#linux

GNU/Linux: Where Data Hides and How It's Found

A partition table entry reading "Hidden FAT16." An inode field nobody writes to. A nanosecond timestamp carrying encoded data. Where GNU/Linux hides evidence and how investigators find it.