Darknet marketplaces in the Tor network are popular places to anonymously buy and sell various kinds of illegal goods. Previous research on marketplaces ranged from analyses of type, availability and quality of goods to methods for identifying users. Although many darknet marketplaces exist, their lifespan is usually short, especially for very popular marketplaces that are in focus of law enforcement agencies.

Recently, steganographic techniques for hiding data in file system metadata gained focus. Tools for commonly used file systems were published but the exFAT file system did not get much attention – probably because its structure provides only few suitable locations to hide data. In this work we present two approaches to hide data in the exFAT file system. While the first approach is more flexible regarding embedding locations, it is rather fragile and provides a lower embedding rate. The second approach, called exHide, has stricter requirements for embedding, but is rather robust and provides a reasonable embedding rate. We describe the design of both approaches, evaluate them, and discuss their weaknesses and advantages.

Darknet marketplaces are an interesting research area. Most marketplaces are hosted in the Tor network as an anonymous onion service. In this paper we provide a generic approach to build a framework for the collection and analysis of product prices and supplies in such marketplaces. We focus on the technical details how to implement such a framework and how to collect, organize, and analyze the product data. For our framework implementation we provide an evaluation based on collected data from three large marketplaces and present an approach to enrich the analyzed data with additional information from external sources.