Anti-Forensics
Definition
Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident responders and was first formalised by Rogers (2005) into the four-class taxonomy of data hiding, artefact wiping, trail obfuscation and attacks against forensic processes.
- Term coined
- Late 1990s, by US incident responders
- Formal taxonomy by
- Rogers (2005)
- Four classes
- Data hiding, artefact wiping, trail obfuscation, attacks on forensic process
- Field
- Digital forensics and incident response
Common questions
What is meant by 'attacks against forensic processes' in Rogers' taxonomy?+
This class targets the investigation itself rather than the evidence, such as exploiting flaws in forensic tools, crafting files designed to crash analysis software, or planting misleading artefacts to send examiners down a false trail.
How does trail obfuscation differ from data hiding?+
Data hiding conceals the existence of evidence, for example inside slack space or steganography, while trail obfuscation leaves evidence discoverable but manipulates it, such as spoofing source addresses or routing through proxies, to break the chain linking the activity back to the attacker.
Related terms
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- USN Journal
- The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...