Subscribe to Anti-Forensics
hex editor
Beat EnCase File Signature Analysis on a Windows System
Use a hex editor to modify the file signature of a WinRAR archive to that of an executable file to beat the EnCase forensic software’s file signature analysis.
Modify NTFS Timestamps and Cover Your Tracks With Timestomp.exe
There have been a million articles written on using timestomp.exe. However, the goal of this article is to give some ideas on how to use timestomp and avoid leaving evidence behind that would point to its use.
Recent Comments