Scribd Logo
Upload

Welcome to Scribd!

  • 88 views

    Anti Forensics

    Uploaded by

    lekha555
    This document defines and discusses anti-forensics, which are tools and techniques that make forensic investigations difficult or impossible. It outlines several categories of anti-forensics including data hiding, artifact wiping, and trail obfuscation. While some see anti-forensics tools as malicious, others believe they can be used to improve digital forensic procedures and tools by highlighting deficiencies. Common anti-forensics techniques discussed are overwriting or destroying data, using disk sanitizers, encryption, steganography, and altering file headers or embedding files in other file types.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    Anti Forensics

    Uploaded by

    lekha555
    88 views12 pages
    This document defines and discusses anti-forensics, which are tools and techniques that make forensic investigations difficult or impossible. It outlines several categories of anti-forensics including data hiding, artifact wiping, and trail obfuscation. While some see anti-forensics tools as malicious, others believe they can be used to improve digital forensic procedures and tools by highlighting deficiencies. Common anti-forensics techniques discussed are overwriting or destroying data, using disk sanitizers, encryption, steganography, and altering file headers or embedding files in other file types.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document defines and discusses anti-forensics, which are tools and techniques that make forensic investigations difficult or impossible. It outlines several categories of anti-forensics including data hiding, artifact wiping, and trail obfuscation. While some see anti-forensics tools as malicious, others believe they can be used to improve digital forensic procedures and tools by highlighting deficiencies. Common anti-forensics techniques discussed are overwriting or destroying data, using disk sanitizers, encryption, steganography, and altering file headers or embedding files in other file types.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    88 views12 pages

    Anti Forensics

    Uploaded by

    lekha555
    This document defines and discusses anti-forensics, which are tools and techniques that make forensic investigations difficult or impossible. It outlines several categories of anti-forensics including data hiding, artifact wiping, and trail obfuscation. While some see anti-forensics tools as malicious, others believe they can be used to improve digital forensic procedures and tools by highlighting deficiencies. Common anti-forensics techniques discussed are overwriting or destroying data, using disk sanitizers, encryption, steganography, and altering file headers or embedding files in other file types.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 12

    ANTI-FORENSICS

    Definition: Anti-Forensics: tools and techniques that frustrate forensic tools,investigations and investigators.

    Dr. Marc Rogers of Purdue University. Dr. Rogers uses a more traditional crime scene approach when defining anti-forensics.

    Attempts to negatively affect the existence, amount and/or quality of evidence from a crime scene, or make the analysis and examination of evidence difficult or impossible to conduct.

    SUB CATEGORIES:
    Data Hiding Artifact Wiping Trail Obfuscation Attack against forensic tools and processes.

    Purpose And Goals


    Common conception: Anti-Forensics tools are malicious and intent. Others believe Anti-Forensics tools should be used to illustrate Deficiency in digital forensic procedures And in Digital forensics tools Forensics examiner education

    Purpose And Goals


    Avoiding detection Disrupting information collection Increasing the examiners time Casting doubt on a forensic report or testimony (Liu and Brown, 2006) Forcing a tool to reveal its presence

    Traditional Anti-forensics Technique


    Overwrite Or Destroying Data: Overwriting of data: Eliminate data or Metadata. Tools used: Washers,Timestamp Eliminators. Disk Sanitizers: Free space sanitizers Tools used: File Shredders

    Data Hiding
    Making data difficult to find. Limit identification and collection of evidence by investigators. Data Hiding tools: Encryption Steganography

    Each data hiding methods makes difficult forensics examination difficult.

    Different Data Hiding Techniques


    Changing the file headers. Other Programs divide files up into small sections and hide each section at the end of each file. Files often have unused space called slack space and you can make use of this slack space for hiding data. Packers is program can insert executable files into other kind of files

    Artifact Wiping
    Permanently eliminating particular files or entire file system. This can accomplished through the use of variety of methods that include Disk Utilities File wiping Utilities.

    Trail Obfuscation
    To Confuse, disorientate and divert the forensic examination process. Variety of tools LogCleaners Spoofing Mis-infomartion

    Counter Measures
    Improve the Tools: Many computer forensics tools are poorly written. Save data where the attackers cant get at it Log Hosts CD-Rs Develop new Tools: Defeat encrypted files system with key loggers.

    References
    http://en.wikipedia.org/wiki/Anticomputer_forensics#Sub-categories http://www.usenix.org/publications/libr ary/proceedings/sec96/boneh.html http://www.simson.net/ref/2007/ICIW .pdf

    You might also like