Anti-forensics Techniques

What is the goal of anti-forensics?

• To make the investigator's task of finding evidence difficult

• To compromise the accuracy of a forensics report or testimony

• To delete evidence that an anti-forensics tool has been run

• All of the above

What happens when a file is deleted from the hard drive in Windows?

• The file contents are immediately erased from the disk

• The file is moved to a temporary storage place called Recycle Bin

• The file is permanently deleted and cannot be recovered

• The file is renamed and hidden in the file system structures

What is file carving?

• A technique to recover files from a hard disk in the absence of file system metadata

• A technique to hide files in the Recycle Bin

• A technique to encrypt files to prevent forensic analysis

• A technique to compress files to minimize their footprint

How can file carving be performed on Windows?

• Using data recovery tools like Autopsy and R-Studio

• Using the copy command in the command prompt

• Using file carving tools like 010 Editor and Hexinator

• Using forensic analysis tools like FTK and EnCase

Which tool can be used to recover deleted files from a Linux system?

• Stellar Phoenix Linux Data Recovery

• Recover My Files

• DiskDigger

• EaseUS Data Recovery Wizard Pro

What are investigators using to scan a disk for lost partitions and recover them?

• R-Studio and EaseUS Data Recovery Wizard

• Passware Kit and L0phtCrack

• OpenStego and StegSpy

• BCWipe Total WipeOut and DriveScrubber

Which technique is used to hide a secret message within an ordinary message?

• Steganography

• Trail Obfuscation

• Alternate Data Streams

• Artifact Wiping

What is the purpose of trail obfuscation in anti-forensics?

• To confuse and mislead the forensic investigation process

• To permanently delete particular files or entire file systems

• To encrypt data of investigative value

• To hide data in Windows NTFS using Alternate Data Streams

Which technique is used to defeat forensic investigation by rendering data virtually unreadable without the designated key?

• Encryption

• Data Deletion

• File Carving

• Password Cracking

What is the purpose of overwriting data/metadata in anti-forensics?

• To make the evidentiary data unavailable to forensic investigators

• To hide messages within ordinary messages

• To permanently delete particular files or entire file systems

• To defeat forensic investigation by rendering data virtually unreadable without the designated key