Section 5.1: Anti-Forensics Overview

Question 1

What is the general use of anti-forensics techiniques?

Answer 1

To hide malware and activity.

Question 2

Anti-forensic techniques that happen on the filesystem:

Answer 2

Timestomping, fileless malware, data encryption, file deletion, and free space wiping.

Question 3

Anti-forensics techniques that happen at the registry:

Answer 3

Registry key/value deletion or wiping. Hiding scripts inside the registry.

Question 4

Other types of anti-forensics:

Answer 4

Event log deletion or tampering, process evasion such as rootkits or code injection.