In this paper, the author looks into several anti-forensics methods and tools, showing examples and comparing results. The scope is limited to hard drive access on a local computer, ignoring topics such as RAM wiping and network forensics. Herein the term “anti-forensics” is used as a singular noun meaning the methods and tools used, as well as the general concept.

If computer forensics “involves obtaining and analyzing digital information for use as evidence” [BN1:2], then anti-forensics involves thwarting the activities of forensics; that is, obscuring or deleting digital information in a way that makes its use as evidence difficult at best. Or, as Scott Berinato of CSO puts it, “Make it hard for them to find you and impossible for them to prove they found you.” [SB1]

Another rationale for using anti-forensics tools is not criminal (depending on who is asked), but rather one of self-preservation. For example, reporters investigating the government within a country with no freedom-of-the-press protections can use anti-forensics to protect sources, hide supporting evidence, and send copy home. Berinato’s quote above applies to this as well.

There are two major ways anti-forensics affect investigations. One is the “black hat” way, in which the bad guys are constantly seeking new tools and methods to escape discovery and prosecution. The “white hat” way, conversely, is a driving force — to develop new techniques that thwart the state-of-the-art tools and force the forensics toolmakers to improve. Both use similar thinking to achieve dissimilar goals.

If one is to believe the doom-sayers, the vault is all but sealed on the coffin of forensic analysis. As is true on the more technological crime-fighting fronts, the “bad guys” have the upper hand. Until we learn how to produce “precogs” and change the criminal justice system to allow conviction before commission (as in [PD1]), the criminals will always know the five Ws of their deeds before investigators.

This is, however, no reason to stop research. We may never know how to thwart the writer of the next piece of malware before it controls a million PCs any more than the next Ted Bundy before his first victim, but that does not mean we shouldn’t try to bring him to justice. Technical investigations are always behind the blade of the bleeding edge of the criminals’ knowledge; that’s the cost of having a technological society full of tech-hungry people.