Week 9 - Anti-Forensics Flashcards
What is Anti-Forensics?
The act of compromosing the availability or usefulness of evidence to the forensics process. This can be encryption, data hiding etc..
What is emerging technologies?
New technologies.
What are the three general strategies of anti-forensics?
Attack on Data
Attack on Tools
Attack on the Analyst
What is an Attack on Data?
When potenital evidence is deleted or tampered with to make it unitelligible or inadmissible in a court of law.
What is an attack on Tools?
When weaknesses in current computer forensics tools are exploited to produce ‘bogus’ investigation results.
What is an Attack on the Analyst?
When problems are creating for the examiner that inhibit the digital forensics process. E.g. generating a huge amount of information that the examiner has to sift through, or casting doubt on the validity of the analysis or the analyst.
TRUE OR FALSE: Analysts may require anonymity.
TRUE.
What are some anti-forensics tactics?
Zero foot printing
Data obfuscation
Data hiding
What is Zero foot printing?
Attenpting to eliminate residual traces of evidence to prevent the analysis of it as evidence. This includes secure deletion of files using shredding or wiping processes.
What is Data obfuscation?
When the nature of data is hidden, e.g. encryption of files, has collisions, modifying metadata or log data, signature analysis attacks.
What is Data hiding?
When evidence is hidden out of sight on a disk. This can include steganography, scattering, hiding in slace space, convert channels, or rootkits.
What must the attacker know to do zero foot printing?
The need to know:
- What interaction took place between the attacker and the system (Assuming the crime was a cyberattack)
- What actions were logged and how (Local or network based, Login, etc.)
- What the “system artifacts” are, i.e. traces that are voluntarily or involuntarily left on the system
What is the main reason for modifying metadata in anti-forensics?
To change the timestamps of certain variables like time created, last modified and accessed. This obscures the actual times the file was interacted with.
What is shredding/wiping?
A process that completely and fully eliminates the data of a file so that it can no longer be accessed and is fully deleted from the system.
What are the two approaches to detecting wiping/shredding operations?
Wipe-trace search
Data deletion ‘anomaly detection’
