Unit 3: Anti-Forensics Techniques and Windows Forensics

Anti-forensics is any deliberate action that reduces the quantity or quality of evidence available to an investigator; Windows forensics is the disciplined recovery of that evidence from the world's most examined operating system. This unit pairs the offense with the defense.

• Locard's exchange principle: every interaction leaves a trace; anti-forensics attacks the trace, not the interaction.
• Order of volatility: evidence decays from CPU registers/cache → RAM → network state → disk → archives; collect most volatile first.
• Integrity chain: every acquired item is hashed (MD5/SHA-256) and logged in a chain of custody so tampering is detectable.
• Categories of anti-forensics: data hiding, artifact wiping, trail obfuscation, and attacks on the tools themselves.

II. Anti-Forensics: Data Destruction and Recovery

Erasing evidence and the techniques that defeat erasure.

A. Understand anti-forensics techniques

Anti-forensics spans four goals: prevent collection, prevent detection, disrupt analysis, and discredit findings.

• Prevent collection: encryption, secure deletion, powering down to lose RAM.
• Prevent detection: steganography, slack-space hiding, timestamp forgery.
• Disrupt analysis: packers, obfuscation, log flooding.
• Discredit findings: planting inconsistent artifacts to undermine credibility in court.

B. Discuss data deletion and recycle bin forensics

Deleting a file usually unlinks it, not erases it, leaving recoverable content.

• Logical deletion: filesystem marks clusters free and removes the directory entry; data persists until overwritten.
• Recycle Bin structure: on NTFS, $Recycle.Bin\<SID> holds paired files — $I<id> stores original path, size, and deletion timestamp; $R<id> holds the actual content.
• Bypass paths: Shift+Delete, files over the bin quota, and removable-media deletions skip the bin entirely.

C. Illustrate file carving techniques and ways to recover evidence from deleted

File carving recovers files from raw data using content signatures, ignoring the filesystem.

• Header/footer carving: scan for magic numbers — JPEG FF D8 FF … FF D9, PDF %PDF … %%EOF.
• Fragment handling: contiguous carving fails on fragmented files; SmartCarving reassembles fragments by content analysis.
• Slack space: the gap between a file's real end and its cluster boundary retains prior data — a rich recovery source.

III. Anti-Forensics: Concealment

Making evidence present but invisible.

A. Explore password cracking/bypassing techniques

Access to protected data is regained by recovering, guessing, or sidestepping credentials.

1. Cracking: attacks the hash directly — dictionary, brute force, and precomputed rainbow tables (defeated by salting).
2. Bypassing: avoids the password — booting to reset the SAM, extracting cached hashes from RAM, or pass-the-hash without ever recovering plaintext.

B. Detect steganography

Steganography hides data inside a carrier so its very existence is concealed.

• LSB embedding: payload bits replace least-significant bits of image pixels or audio samples, invisible to the eye.
• Steganalysis: chi-square and RS analysis detect statistical anomalies in bit distributions; file-size mismatches and known-tool signatures also expose carriers.

C. Hidden data in file system structures

Filesystem metadata offers many places to stash data outside normal file listings.

• NTFS ADS: alternate data streams (file.txt:hidden.exe) attach unseen content to a visible file.
• Reserved regions: $Boot, unused MFT records, and the volume boot record can carry payloads.
• Bad-block trickery: clusters falsely marked bad in $BadClus are ignored by the OS but readable directly.

D. Trail obfuscation

Trail obfuscation confuses the timeline and attribution rather than deleting evidence.

• Timestomping: editing MACB (Modify, Access, Change, Birth) timestamps to forge chronology.
• Log/spoofing noise: spoofed IPs, false headers, and log flooding bury the real events.
• Detection: $STANDARD_INFORMATION and $FILE_NAME timestamps disagree when only the former is stomped.

IV. Anti-Forensics: Wiping, Encryption, and Concealed Code

Techniques that destroy or shield evidence, and their countermeasures.

A. Understand techniques of artifact wiping

Artifact wiping physically overwrites data so recovery is impossible.

• Disk/file wiping: tools overwrite clusters with zeros, ones, or random passes; single-pass overwrite defeats software recovery on modern drives.
• Metadata wiping: clearing MFT entries, event logs, and registry keys removes secondary traces the file left behind.

B. Overwritten data/metadata detection and encryption

Overwriting leaves detectable side-effects, and encryption blocks reading entirely.

• Overwrite artifacts: wiping-tool signatures, uniform zero-fill regions, and orphaned metadata pointers reveal that data once existed.
• Encryption: full-disk (BitLocker) or file-level (EFS) renders content unreadable; the investigator's route is the key — from RAM, escrow, TPM, or recovery agents — not the ciphertext.

C. Detect program packers and footprint minimizing techniques

Packers compress and encrypt executables so malicious code resists static analysis.

• Packer signs: high entropy (near 8 bits/byte), few imports, tiny sections that expand at runtime; identified by tools like PEiD/DIE.
• Footprint minimizing: fileless malware that lives only in RAM or registry and leaves nothing on disk to carve.

D. Understand anti-forensics countermeasures

Countermeasures restore evidentiary value despite obstruction.

• Live acquisition: capture RAM before shutdown to defeat encryption and fileless techniques.
• Cross-artifact correlation: confirm one artifact against several independent sources so a single forged trace cannot mislead.
• Hardware imaging: read raw sectors to expose slack, bad-block, and ADS hiding.

V. Windows Forensics: Evidence Acquisition

Collecting data in the correct order of volatility.

A. Collect volatile and non-volatile information

Acquisition sequence follows evidence lifespan.

1. Volatile: RAM, running processes, network connections, open ports, logged-on users, clipboard — lost on power-off; captured live.
2. Non-volatile: disk files, registry hives, event logs, slack space — survive reboot; captured via forensic imaging with write-blockers.

B. Perform Windows memory and registry analysis

Memory and the registry are the richest structured evidence stores.

• Memory analysis: a RAM image analyzed with Volatility yields processes (pslist), injected code (malfind), and cleartext keys/passwords.
• Registry hives: SYSTEM, SOFTWARE, SAM, SECURITY, and per-user NTUSER.DAT; UserAssist records program-launch counts, Run keys record persistence.

VI. Windows Forensics: Browser and User Artifacts

Reconstructing user activity from cached and recorded data.

A. Examine the cache

The browser cache stores fetched resources locally, proving what a user viewed and when.

• Storage: cached pages, images, and scripts with timestamps survive even after history is cleared.
• Chrome example: the Cache folder plus index file map URLs to cached content, dating each visit.

B. Cookie and history recorded in web browsers

Cookies and history reveal sites, sessions, and search terms.

• History: Chrome's History SQLite DB (urls, visits tables) logs URL, title, visit count, and time.
• Cookies: the Cookies DB stores host, name, value, and expiry — evidence of authenticated sessions.

C. Examine Windows files and metadata

Files carry embedded metadata that supports or contradicts user claims.

• NTFS MFT: every file has an MFT record with MACB timestamps and resident data for small files.
• Embedded metadata: Office/EXIF fields hold author, GPS, and revision history independent of filesystem times.

VII. Windows Forensics: System Artifacts and Logs

Structured records of user and system behavior.

A. Understand shellbags, LNK files and jump lists

These artifacts prove folder access and file usage, even after deletion.

• Shellbags: in UsrClass.dat, record which folders (including removable/network) a user browsed and their view settings.
• LNK files: shortcuts in Recent store target path, size, and MACB times of opened files.
• Jump lists: in AutomaticDestinations-ms, tie recently opened documents to specific applications.

B. Understand text-based logs and Windows event logs

Logs give a timestamped narrative of system and security events.

1. Text-based logs: plain-text files such as setupapi.dev.log (device installs) and IIS web logs — easily edited, so verify integrity.
2. Windows event logs: binary .evtx files (Security, System, Application); Event ID 4624 logon success, 4625 failure, 1102 log cleared — the last itself flags anti-forensic tampering.