Subscribe to Anti-Forensics
Anti-Forensics Software
Anti-forensics software and sourcecode
Breaking Forensic Images Booted as a Virtual Machine
I’ve dug around a bit and found some older examples of software that will detect whether or not the current system is being run in a virtual environment. The main purpose here is to trip up the examiners. Make them waste their time, their clients time and everyone elses. Make the costs of a computer forensics examination even more expensive.
Modify NTFS Timestamps and Cover Your Tracks With Timestomp.exe
There have been a million articles written on using timestomp.exe. However, the goal of this article is to give some ideas on how to use timestomp and avoid leaving evidence behind that would point to its use.
Recent Comments