Subscribe to Anti-Forensics
Operating Systems
The Risks of Windows Hibernation – The hiberfil.sys and Web Browsing
You can use Windows Hibernate to conserve batteries, electricity, save the environment, the world and the polar bears. However, did you know that by putting your computer into “hibernation” mode that you are essentially creating a snapshot of the contents of your computers RAM which is then saved to the root of the hard drive as “hiberfil.sys”?
Meta Anti-Forensics (Conference talk by The Grugq)
Another presentation by The Grugq and his knowledge and contributions to the anti-forensics community during his computer forensic and anti-forensic research. The video below is a presentation The Grugq performed at Hack in the Box 2007 security conference. The Grugq covers anti-forensics techniques as well as the HASH or hacker shell which he developed.
The Art of Defiling: Defeating Forensic Analysis on Unix Filesystems (Conference talk by The Grugq)
The Grugq has contributed greatly to the anti-forensics community during the course of his of computer forensic and anti-computer forensic research. This must watch presentation on anti-forensics will familiarize you on Unix file system structure, common forensic tools and some theories behind file system anti-forensic attacks.
Delete USB Device History from the Windows Registry (USBSTOR key) and the setupapi.log
This article covers the USBSTOR registry key and the setupapi.log file and methods to delete them. These two artifacts can contain data regarding USB devices that have been plugged into a system. There are other things you should be aware of as well which are covered in the article. Sometimes just deleting a registry key or file is not enough.
Leave No Artifacts Behind – Linux Live CDs
There are a few main reasons to use Linux Live CDs for privacy or your other activities. For example, when you are browsing web pages there are artifacts or evidence of what you’ve done being cached to the hard drive.
Disable the LastAccess Timestamp in Windows XP
Requirements Administrator account Windows XP Command Summary Login as Administrator Open a command prompt Enter the command: fsutil behavior set disablelastaccess 1 Restart computer Purpose I’ll come right out and say that this is definitely not a strong anti-forensic technique but it can be helpful. Most forensic examiners already know they can’t rely heavily on lastaccess [...]
Recent Comments