Skip to content

Commit 4750c62

Browse files
az0az0
committed
Overhaul documentation about chaff
1 parent 8cc146e commit 4750c62

2 files changed

Lines changed: 250 additions & 45 deletions

File tree

‎_posts/2015-09-25-shred-files-and-wipe-disks.md‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -107,21 +107,18 @@ However, in practice things become more complicated.
107107

108108
Here are some suggestions to keep your data private
109109

110-
1. Don't keep secrets. It's easier to sleep.
111-
2. Don't waste time with multiple passes for data sanitation.
112-
3. Second guess any software which advertises multiple passes to wipe files or free disk space. Do the authors not honestly know what they are doing, or is a useless feature for marketing purposes?
113-
4. Use full volume encryption, though someone may [hit you with a $5 wrench](https://xkcd.com/538/) until you reveal the key.
114-
5. If giving a hard drive (or whole computer) to someone else, use DBAN to wipe the entire drive, including the remapped sectors—even though reinstalling an operating system, security updates, applications, and settings is a pain. It's not enough to delete files, empty the recycle bin (or trash can), and wipe the free space because some useful data may be in the swap file, hibernation file, Windows registry, and application registries (such as passwords in Firefox's configuration). If you are not willing to do that, minimally delete the user accounts on the system and _then_ wipe free disk space.
115-
6. If you need DoD class security, use the only sanitation method approved by the DoD 5220.22-M standard: degauss or mechanically destroy the storage device.
116-
7. Don't assume you control all the data. Say you download a file from www.example.com: there may be records on your computer, your ISP, www.example.com's server, www.example.com's ISP, www.example.com's backup site, the Internet backbone, etc. Think about how much data is stored on your email server, Facebook account, etc.
117-
8. Don't use any computers because the Nosy Secret Agents may looking over your shoulder using Van Eck phreaking.
110+
0. Don't keep secrets. It's easier to sleep.
111+
0. Don't waste time with multiple passes for data sanitation.
112+
0. Second guess any software which advertises multiple passes to wipe files or free disk space. Is it snake oil?
113+
0. Use full volume encryption, though someone may [hit you with a $5 wrench](https://xkcd.com/538/) until you reveal the key.
114+
0. If you want to make forensic recovery slower and more expensive, generate large volumes of semi-realistic decoy data with [Chaff](/doc/chaff.html). This complements other methods; it does not replace them.
115+
0. If giving a hard drive or whole computer to someone else, use DBAN to wipe the entire drive, including the remapped sectors—even though reinstalling an operating system, security updates, applications, and settings is a pain. It's not enough to delete files, empty the recycle bin (or trash can), and wipe the free space because some useful data may be in the swap file, hibernation file, Windows registry, and application registries (such as passwords in Firefox's configuration). If you are not willing to do that, minimally delete the user accounts on the system and _then_ wipe free disk space.
116+
0. If you need DoD class security, use the only sanitation method approved by the DoD 5220.22-M standard: degauss or mechanically destroy the storage device. No software can physically do this.
117+
0. Don't assume you control all the data. Say you download a file from www.example.com: there may be records on your computer, your ISP, www.example.com's server, www.example.com's ISP, www.example.com's backup site, the Internet backbone, etc. Think about how much data is stored on your email server, Facebook account, etc.
118+
0. Don't use any computers because the Nosy Secret Agents may be looking over your shoulder using Van Eck phreaking.
118119

119120
## Suggested reading
120121

121122
* ["Data Remanence"](https://en.wikipedia.org/wiki/Data_remanence) (Wikipedia)
122123
* ["Gutmann method: criticism"](https://en.wikipedia.org/wiki/Gutmann_method#Criticism) (Wikipedia)
123124
* [One big file is not enough: A critical evaluation of the dominant free-space sanitization technique](https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.117.694&rep=rep1&type=pdf) (Garfinkel and Malan, 2006)
124-
125-
126-
127-

‎_posts/2019-08-14-chaff.md‎

Lines changed: 241 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,256 @@
11
---
22
layout: page
3-
title: "BleachBit Chaff – How to Disguise Deleted Files"
3+
title: "BleachBit Chaff: Hide Private Files Using Decoy Data"
44
nav_title: "Chaff"
55
category: doc
66
date: 2000-08-14 20:45:26
77
---
88

9-
For aircrafts, chaff is a physical countermeasure that confuses radar by making it
10-
seem like there are additional aircraft in the sky, and chaff protects the aircraft
11-
by misdirecting radar-guided missiles.
129

13-
Likewise, BleachBit version 3 introduces a basic chaff system that creates files to
14-
confuse digital forensics. Think of it also like the metaphor of the needle in the haystack.
15-
The needle represents the files you want to keep private, and the chaff is the haystack that makes
16-
the needle difficult to find because the forensic investigator has more junk to sift through
17-
before finding all the needles.
10+
When you delete a file, traces can remain on your storage drive, and
11+
digital forensics tools are designed to find them. BleachBit's **Chaff**
12+
feature gives you an extra layer of protection by flooding your drive
13+
with realistic-looking decoy files, making it far harder for investigators
14+
to locate the data that matters.
1815

19-
Does this imply that using BleachBit to delete other data, such as browser history,
20-
is counterproductive? No. Use BleachBit to remove any private data you don't want found.
21-
However, there may be private data you decide to keep or forgot to clean, and chaff is
22-
one of an array of options to protect this private data. Of course, please also consider
23-
other options such as encryption!
16+
---
17+
18+
## What Is Chaff?
19+
20+
The term comes from military aviation: aircraft release clouds of metallic
21+
chaff to confuse radar and misdirect guided missiles. BleachBit borrows
22+
this idea for the digital world, generating enough realistic-looking noise
23+
that finding your actual private data becomes like finding a needle in a
24+
haystack.
25+
26+
Chaff files are **not empty, not random bytes, and not obviously fake**.
27+
BleachBit uses a statistical model called a **Markov chain** to generate
28+
text that looks like real English at a glance, but is actually meaningless.
29+
This makes chaff much harder for forensic tools to automatically identify
30+
and skip.
31+
32+
---
33+
34+
## How Chaff Fits Into Your Privacy Strategy
35+
36+
Chaff is a **complementary** tool, not a replacement for other privacy practices.
37+
Here's how it fits:
38+
39+
| Method | What It Does |
40+
|---|---|
41+
| **Secure deletion** | Removes files so they can't be recovered |
42+
| **Encryption** | Makes files unreadable without a key |
43+
| **Chaff** | Buries remaining traces in a sea of decoy data |
44+
| **Steganography** | Hides data inside other files |
45+
46+
**Use chaff when:**
47+
- You've deleted sensitive files but want to make forensic recovery harder
48+
- You have private files you're keeping, and want them to be difficult to locate among many decoys
49+
- You want to increase the time and cost of any forensic investigation
50+
51+
> **Tip:** Chaff works best alongside encryption. Even if an investigator finds your real files amid the decoys, encryption ensures they can't read them.
52+
53+
---
54+
55+
## Getting Started: How to Generate Chaff Files
56+
57+
1. Install and open BleachBit.
58+
2. From the application menu, click **Make Chaff**.
59+
3. Choose an **inspiration model** (see below).
60+
4. Set the **number of files** to generate.
61+
5. Choose the **destination directory**.
62+
6. Click **Generate**.
63+
64+
### Choosing an Inspiration Model
65+
66+
BleachBit ships with two built-in models:
67+
68+
- **Hillary Clinton Emails**: Based on emails released by the U.S. Department of State.
69+
Generates files that seem like real email messages.
70+
- **2600: The Hacker Quarterly**: Based on a well-known computer underground magazine.
71+
Produces text with technical and hacker-culture keywords that may appear interesting
72+
to forensic keyword scans.
73+
74+
Choose the model whose output best resembles the kind of data you're protecting, or use
75+
both for variety.
76+
77+
---
78+
79+
## How to Delete Chaff Files
80+
81+
When you're done with chaff files, **delete them normally — do not shred them.**
82+
83+
- **Shredding** removes all traces, which defeats the purpose.
84+
- **Normal deletion** leaves behind recoverable fragments, which adds to the haystack
85+
and slows down any investigation.
86+
87+
By default, BleachBit uses normal deletion.
88+
89+
---
90+
91+
## Advanced: Hiding Data Inside Chaff (Steganography)
92+
93+
BleachBit doesn't include steganography tools, but you can combine chaff with tools
94+
like **Steghide** or **OpenStego** to hide actual data inside chaff files. An
95+
investigator who encounters thousands of chaff files cannot safely whitelist them:
96+
each one could potentially contain hidden data, forcing a thorough (and expensive)
97+
examination of every file.
98+
99+
---
100+
101+
## Frequently Asked Questions
102+
103+
### Is chaff foolproof?
104+
105+
No. Chaff is one layer of a defense-in-depth approach. A determined investigator
106+
with enough time and resources may identify and filter out chaff, especially if
107+
it lacks variety or doesn't resemble your real data. Combine chaff with encryption
108+
and secure deletion for the strongest protection.
109+
110+
### How convincing is BleachBit's chaff?
111+
112+
At a glance, the generated files look like real documents. However, at a closer
113+
look, they are nonsense. They are designed to be good enough to slow down an
114+
investigator, not to fool a human reviewer.
115+
116+
Actual sample from 2600:
117+
118+
> The government says that this constitutes true 'misuse' of computers.
119+
120+
And from the Clinton emails:
24121

25-
BleachBit uses a statistical model called Markov chains to learn a document as inspiration
26-
and then use it to generate random text that is difficult for an investigator to fingerprint.
27-
At a glance, the chaff files seem to be English, but a closer inspection reveals they are
28-
nonsense, so do not spend much time reading them looking for any wisdom.
122+
> Thx so much influence over diplomacy by shutting out a new uranium
123+
> enrichment plant.
29124
30-
BleachBit 3.0 comes with two statistical models. The first model was inspired by [Hillary
31-
Clinton's emails as released by the United States Department of State](https://foia.state.gov/Search/Collections.aspx).
32-
Please remember that [FBI documents](https://www.bleachbit.org/press) indicate Clinton's
33-
IT guy used BleachBit to wipe emails from her private server, and now BleachBit can also
34-
do the opposite: generate Clinton's emails.
125+
What chaff lacks in realism, it makes up for in volume.
35126

36-
The second model was inspired by [2600: The Hacker Quarterly](https://2600.com), a magazine
37-
of the computer underground, to yield more interesting keywords that might show up on the
38-
forensic investigator's scans.
127+
### Why not just use empty or null files?
39128

40-
When making chaff files, either leave them undeleted or delete them without shredding
41-
them. Shredding them would remove any trace, which would be counterproductive,
42-
but deleting them without shredding can slow down the forensic investigator.
129+
Null bytes are trivially easy for forensic tools to detect and skip. An empty
130+
haystack doesn't hide anything.
131+
132+
### Why not use files filled with random data?
133+
134+
Standards like DoD 5220.22-M and NIST 800-88 describe random-data wiping,
135+
while chaff's text more resembles interesting data.
136+
137+
Random wiping generates data that looks like:
138+
139+
>5q_R<kPi|\@AG(q-HkQM{0>32aG3NmL^IM38ItezE#eLo0TOyf
140+
141+
Compare to:
142+
143+
>Around two in the book but not necessarily bad, but it cannot
144+
>resolve political or cultural sources of conflict.
145+
146+
Which one would catch your attention longer?
147+
148+
### What is a Markov chain?
149+
150+
Markov chains date back to 1907 work by Russian mathematician
151+
Andrey Markov.
152+
153+
The application of Markov chains to text generation dates to Claude
154+
Shannon's 1948 paper. Shannon observed that "the resemblance to ordinary
155+
English text increases quite noticeably" as one increases the length of the
156+
Markov chain.
157+
158+
### How does a Markov chain work?
159+
160+
Imagine you have one sentence that you feed into a Markov chain:
161+
162+
"The cat sat on the mat"
163+
164+
The Markov chain would analyze the probability of which words
165+
follow other words. For example, it might determine that "cat" is
166+
followed by "sat" 100% of the time in the input text. Then it would
167+
generate new text based on those probabilities.
168+
169+
The math is simple enough that you can understand it without a PhD.
170+
It would be tedious, but you could generate text using Markov chains
171+
manually.
172+
173+
### Does chaff generation use AI?
174+
175+
No. BleachBit uses Markov chains, which are a much older, simpler, faster,
176+
and more efficient alternative to AI LLMs, like ChatGPT, for generating large volumes
177+
of text.
178+
179+
### Why not use an AI / LLM to generate chaff?
180+
181+
LLMs produce highly realistic text, but they're slow and expensive at the volumes
182+
needed to generate gigabytes of chaff. Markov chains are fast and cheap for mass
183+
production. You could use an LLM to seed a small set of high-quality decoy
184+
documents and then multiply them using the methods below.
185+
186+
Tip: If sensitivity allows, consider giving the LLM a sample of your documents,
187+
and then prompt it to generate more in the same style while changing the content.
188+
Local AIs like ollama may be a better choice for sensitive documents.
189+
190+
### Can I generate chaff without special software?
191+
192+
Yes, using a copy-and-paste doubling method:
193+
194+
1. Find or create documents similar to the data you're hiding.
195+
2. Copy them and paste duplicates into the same folder.
196+
3. Select all files (originals + copies) and repeat.
197+
198+
Each cycle doubles the file count. It's fast and requires no extra software,
199+
but the variation is low: once an investigator identifies the original set,
200+
duplicates can be skipped quickly. Combine this with other methods for better results.
201+
202+
### What about other decoy file tools?
203+
204+
- **[DFGenerator](https://github.com/chribonn/DFGenerator)** (Windows): Copies a directory
205+
structure and replaces sensitive content with random data. No longer maintained.
206+
- **Vovsoft Dummy File Generator** — Creates realistic file containers (PDFs, etc.), but
207+
the contents are trivially simple (e.g., "hello world"), making them easy to identify.
208+
- **Large downloads (Linux kernel ~7 GB, Wikipedia ~20 GB)** — Good if your real data is
209+
source code or reference articles, respectively, since the decoys closely resemble the target data.
210+
211+
### How do forensic investigators counter chaff?
212+
213+
The primary countermeasure is **data winnowing**, which is a technique that clusters similar
214+
documents together. Given a known sample of either real or fake data, winnowing helps
215+
investigators quickly find more of the same type and separate it from the rest.
216+
217+
To make chaff more resilient against winnowing, use **high variety** across the decoy files
218+
and ensure they overlap stylistically with your real data.
219+
220+
### What are other names for chaff?
221+
222+
There's no single widely-adopted term. You may also see it called:
223+
224+
- Decoy files / dummy files / noise files
225+
- Fake documents / junk data
226+
- Digital noise generation
227+
228+
"Disinformation" is false information shared deliberately to deceive or
229+
manipulate and operates at the psychological or social level, not the
230+
technical level. Chaff is a technical countermeasure that is not convincing
231+
at close examination.
232+
233+
"Digital camouflage" more accurately describes steganography, where
234+
target data is hidden *inside* other data.
235+
236+
### Is the Clinton reference a political statement?
237+
238+
No. The collection of emails was chosen for two reasons: it's a large,
239+
publicly available dataset of real professional correspondence that
240+
works well as Markov chain training data, and there's a historical nod:
241+
BleachBit became widely known when it was revealed it was used to wipe
242+
Clinton's emails. In an ironic twist, BleachBit can generate emails
243+
inspired by that collection.
244+
245+
Including that corpus is an acknowledgment of that history, not a
246+
political endorsement or criticism of anyone involved.
247+
248+
---
43249

44-
While BleachBit itself does not implement any steganography, a savvy user can consider
45-
hiding private data in the seemingly-useless chaff files. Just this possibility
46-
implies a thorough digital forensics investigation would require examining the contents
47-
of the chaff files rather than whitelisting them.
250+
## Summary
48251

252+
BleachBit's Chaff feature is a practical tool for making digital forensics
253+
investigations slower, harder, and more expensive. It's most effective when
254+
combined with encryption, secure deletion, and a high volume of varied decoy
255+
files. No single privacy tool is foolproof, layering multiple methods gives
256+
you the strongest protection.

0 commit comments

Comments
 (0)