Anti-Forensics
Definition
Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident responders and was first formalised by Rogers (2005) into the four-class taxonomy of data hiding, artefact wiping, trail obfuscation and attacks against forensic processes.
Related terms
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
Explained in
- Anti-Forensic Techniques and Investigator Counter-MethodsAny deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident responders and was first...