nemo

Nemo is a command line tool for hiding, finding, and removing hidden data on NTFS, APFS, and ext4. It is written in Go and runs on Linux, macOS, and Windows. Live writes on Windows are not supported yet.

It has two modes:

Image mode works offline on a raw, unencrypted disk image.
Live mode works on the filesystem of the machine you are running on.

Modes lists what each platform supports. To try nemo, grab a test image below.

Install

On Linux or macOS:

curl -fsSL https://raw.githubusercontent.com/sahithyandev/nemo/main/scripts/install.sh | sh

On Windows (PowerShell):

powershell -c "irm https://raw.githubusercontent.com/sahithyandev/nemo/main/scripts/install.ps1 | iex"

Each script downloads the latest release for your OS and architecture from the releases page. If you’d rather not pipe a script into your shell, read it first.

A quick example

No disk image of your own? Download apfs-bare and unpack it:

curl -fsSLO https://raw.githubusercontent.com/sahithyandev/nemo/main/testdata/apfs-bare.img.gz
gunzip apfs-bare.img.gz

The file xattr.txt on that image already has data hidden in it. Find it:

nemo detect xattr.txt \
  --image apfs-bare.img

TECHNIQUE      TARGET       LOCATION         SIZE
named-stream   xattr.txt    user.nemo.test   4

Now hide something of your own in hello.txt:

nemo hide hello.txt \
  --technique named-stream \
  --data secret.bin \
  --stream-name notes \
  --image apfs-bare.img

Read it back out:

nemo extract hello.txt \
  --technique named-stream \
  --stream-name notes \
  --image apfs-bare.img

Remove it, which puts hello.txt back the way it was:

nemo clear hello.txt \
  --technique named-stream \
  --stream-name notes \
  --image apfs-bare.img

To see which filesystem and technique pairs nemo supports:

nemo features

Every command and flag is in the CLI reference.

Test images

These are small, disposable APFS images. They live in the repo and nemo’s own tests use them. Each one is gzipped, so run gunzip <file>.gz after downloading.

All but apfs-encrypted hold the same files:

hello.txt
xattr.txt, with a named stream
slack.bin, with trailing slack
bigxattr.txt
rsrc.txt, with a resource fork

So every example above works on any of them.

Image	What's different about it
`apfs-bare`	no partition map, the plainest container	Download
`apfs-gpt`	GPT-wrapped, the default macOS layout	Download
`apfs-casesensitive`	case-sensitive volume	Download
`apfs-16k`	16 KiB blocks instead of the usual 4 KiB	Download
`apfs-manyfiles`	2000+ files, forces a multi-level B-tree	Download
`apfs-multivol`	two volumes in one container	Download
`apfs-encrypted`	encrypted and empty, nemo should refuse it	Download

To download from the command line, put the image name in this command:

curl -fsSLO https://raw.githubusercontent.com/sahithyandev/nemo/main/testdata/<image>.img.gz

Scope

In scope

NTFS, APFS, and ext4
Named-stream hiding, slack-space hiding, and timestomping
Image mode and live mode
Hide, detect, extract, and clear commands
Chain-of-custody logging and SHA-256 hashing
Validation against a public dataset

Out of scope

FAT32 and exFAT
Deleted-file recovery and file carving
Malware execution
Privilege escalation or bypassing
A GUI

Some of these may come later, but none are planned.

Several anti-forensic techniques close to nemo’s three are also out of scope, from unallocated-space hiding to snapshot stashing. Adjacent techniques explains what they are and why nemo skips them.

Where to go next

Use the tool: CLI reference
Learn the techniques: Techniques
Contribute a filesystem or technique: How techniques work, Architecture, and File systems