Anti Forensics

Anti-Forensics

Supplementary Files:

• payloads.md — Command reference covering secure file deletion, disk/volume encryption, log cleaning, timestamp manipulation, steganographic hiding, and anti-forensic countermeasure testing
• test-cases.md — Structured test case list covering secure deletion verification, encrypted volume creation, log cleaning, timestamp manipulation, steganographic hiding, and bulk_extractor detection testing
• guides/filesystem-anti-forensics.md — Deep dive into secure deletion, slack space wiping, MFT/inode manipulation, and forensic artifact cleanup
• guides/log-tamper-timestamp.md — Deep dive into log tampering, timestamp manipulation, event log injection, and defeating timeline analysis
• guides/crypto-hide-data-destruction.md — Deep dive into encrypted volumes, steganographic hiding, deniable encryption, and bulk_extractor effectiveness testing

Summary

Anti Forensics skill domain covering forensics operations.

Tools: shred, wipe, tcplay, logtamper, timestomp, bulk_extractor, steghide, Real-Time Logging (+6 more)

Domain: forensics

MITRE ATT&CK: TA0005-Defense Evasion

Description

Anti-forensics is the offensive counterpart to digital forensics. While the digital-forensics skill focuses on evidence collection and analysis, this skill covers the techniques attackers use to prevent evidence collection, corrupt evidence, or hide data from forensic examination. Understanding these techniques is essential for penetration testers who must simulate realistic attack scenarios and for defenders who need to know what anti-forensic artifacts to look for.

The agent has mastered secure file deletion with shred and wipe, encrypted volume management with tcplay (TrueCrypt/VeraCrypt compatible), log manipulation with logtamper, timestamp forging with timestomp, forensic artifact extraction with bulk_extractor (used defensively to test anti-forensic effectiveness), and steganographic data hiding with steghide.

Use Cases

1. Post-Exploitation Cleanup - After completing a penetration test, securely remove dropped tools, modified configurations, and log entries to simulate how a real attacker would cover their tracks
2. Data Exfiltration Channel Testing - Use steganographic hiding and encrypted volumes to test whether the target organization's data loss prevention (DLP) and forensic capabilities can detect hidden data channels
3. Forensic Readiness Assessment - Test the effectiveness of an organization's forensic tools and procedures by attempting anti-forensic techniques against a controlled environment, then verifying what artifacts remain detectable
4. Red Team Evasion Validation - Validate that red team operations can achieve realistic anti-forensic objectives, ensuring blue team detection rules are tested against the latest evasion techniques
5. Incident Response Training - Create realistic scenarios where defenders must detect anti-forensic activity including timestamp manipulation, log cleaning, and steganographic data exfiltration

Core Tools

Methodology

Attack Chain

Pre-Operation               Active Operations              Post-Operation
(Encrypted Volume           (Log Manipulation,             (Secure Deletion,
 Setup, Stego Prep)         Timestamp Forging)              Stego Extraction)
       |                          |                              |
       v                          v                              v
                                  Verification
                                  (bulk_extractor scan
                                   to confirm no artifacts
                                   remain detectable)

Phase Details:

1. Pre-Operation - Create encrypted containers with tcplay for storing tools and exfiltrated data. Prepare steganographic carrier files. Establish a clean baseline of the target system's log state and timestamps for later restoration.
2. Active Operations - During the engagement, manipulate logs in real-time using logtamper to remove evidence of access. Forge file timestamps with timestomp to blend malicious files with legitimate ones. Use steganographic channels to exfiltrate data without triggering DLP alerts.
3. Post-Operation Cleanup - Securely delete all dropped tools, temporary files, and artifacts using shred and wipe. Restore log files to their pre-engagement state. Verify timestamps are consistent. Remove any traces of encrypted volume mounts.
4. Verification - Use bulk_extractor against the target disk image to confirm no recoverable artifacts remain. Test whether forensic timeline analysis can detect the engagement activities. Validate that steganographic carriers pass visual and statistical analysis.

Practical Steps

Step 1: Secure Data Destruction

Use shred to overwrite file contents with multiple passes of random data before deletion, making recovery impossible with standard forensic tools. Use wipe for recursive directory cleaning. Understand which filesystems and storage technologies (SSDs with wear leveling, copy-on-write filesystems like ZFS/Btrfs) reduce the effectiveness of these tools.

Step 2: Encrypted Volume Management

Create and manage encrypted volumes with tcplay (TrueCrypt/VeraCrypt compatible) for plausible deniability and secure storage. Understand hidden volume creation, keyfile-based authentication, and how encrypted containers appear in forensic analysis.

Step 3: Log Manipulation and Timestamp Forging

Use logtamper to selectively remove or modify log entries, and timestomp to forge file MAC timestamps. Understand the forensic artifacts these techniques leave behind (journal entries, NTFS $STANDARD_INFORMATION vs $FILE_NAME discrepancies, log sequence gaps).

Step 4: Steganographic Data Hiding

Embed data within image and audio files using steghide to create covert exfiltration channels. Understand capacity limits, statistical detection methods, and how to choose carrier files that minimize detectability.

Step 5: Anti-Forensic Effectiveness Testing

Use bulk_extractor and other forensic tools against the target environment to verify anti-forensic measures are effective. If bulk_extractor can still recover artifacts, iterate on cleanup techniques until the desired level of forensic resistance is achieved.

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Defense Perspective

Common Pitfalls

• Ignoring SSD wear leveling and CoW filesystems: shred and wipe are designed for magnetic media. On SSDs with wear leveling, Btrfs, or ZFS, overwritten data may persist in flash pages or filesystem snapshots. Always verify the underlying storage technology before relying on secure deletion tools.
• Forgetting about swap, hibernation, and temp files: Even after securely deleting the primary file, sensitive data may persist in swap partitions, hibernation files (hiberfil.sys), temporary directories, or application caches. A comprehensive cleanup must address all potential data leakage points.
• Modifying timestamps without understanding forensic detection: Timestomp only modifies the $STANDARD_INFORMATION timestamp on NTFS, leaving the $FILE_NAME timestamp unchanged. Forensic examiners routinely compare both attributes, making naive timestamp manipulation immediately detectable. Logtamper creates sequence gaps that automated timeline tools flag as anomalies.

Automation and Scripting

Automate post-operation cleanup with scripts that chain secure deletion, log restoration, and timestamp normalization. Build a cleanup pipeline that: (1) identifies all files created during the engagement by timestamp range, (2) shreds each file with appropriate passes, (3) removes log entries matching engagement IP addresses and usernames, (4) restores file timestamps using the pre-operation baseline, and (5) runs bulk_extractor against a disk image snapshot to verify no recoverable artifacts remain. Use tcplay in scripted mode to create and mount encrypted volumes without interactive prompts, enabling automated secure storage during engagements.

Legal and Ethical Considerations

Anti-forensic techniques must only be used within authorized penetration testing engagements with explicit written permission. Destroying evidence on systems you do not own or without authorization is a criminal offense in most jurisdictions (e.g., 18 U.S.C. 1519 in the United States, Computer Misuse Act Section 3 in the UK). Even within authorized engagements, document all anti-forensic actions thoroughly so the client understands what was cleaned and what forensic artifacts may remain for their incident response team.

Integration with Other Tools

Anti-forensics connects directly to the digital-forensics skill domain. Every anti-forensic technique has a corresponding forensic detection method, and understanding both sides makes each more effective. The steganography skill provides additional steganographic tools beyond steghide (zsteg, stegcracker, stegseek). Post-exploitation techniques often require anti-forensic cleanup to maintain persistence without detection. Binary reverse engineering helps analyze anti-forensic tools themselves to understand exactly what artifacts they leave behind.

Detection Methods

Anti-forensic activity leaves distinctive traces that forensic examiners and EDR/XDR platforms detect through timeline analysis, entropy scanning, and behavioral anomalies.

Filesystem-Level Indicators

• Secure deletion signatures: shred, wipe, srm, bcwipe process execution; high-entropy writes followed by file truncation.
• Timestamp manipulation: NTFS $STANDARD_INFORMATION vs $FILE_NAME mismatch (timestomp signature); MAC times that don't fit timeline baseline.
• Encrypted volume creation: tcplay, VeraCrypt, LUKS device mapper events; loop device creation; partition table changes; sudden high-entropy partition.
• Hidden partition indicators: GPT entries with mismatched partition sizes; hidden sectors between visible partitions.
• Alternate Data Streams (ADS): NTFS file size anomalies; zone identifier misuse.

Log Tampering Indicators

• Missing log sequence: Windows Event Log gaps (sequence number jumps); missing syslog entries between specific timestamps.
• Suspicious log clearing: Event ID 1102 (Audit log cleared); /var/log/auth.log truncation; inotifywatch events on /var/log/.
• Log injection artifacts: Unusual awk/sed invocations on log files; rootkits with prctl syscalls hiding processes.
• Time skew: System clock changes (Event ID 4616); NTP sync anomalies following user-mode time writes.

Memory Forensics Indicators

• Process hollowing signatures: Volatility malfind output with PAGE_EXECUTE_READWRITE permissions; hollowed process with mismatched PEB.
• DKOM (Direct Kernel Object Manipulation): Hidden processes (psxview mismatch); unlinking from EPROCESS ActiveProcessLinks.
• Rootkit hooks: SSDT hooks; IRP hooks; inline function hooks in ntdll.dll/libc.so.
• Shellcode in memory: MEM_PRIVATE | MEM_EXECUTE regions; RWX pages outside loaded modules.

SIEM Detection Rules

• Splunk SPL: index=linux sourcetype=auditd type=EXECVE | search a0 IN ("shred","wipe","srm","tcplay")
• Sysmon Event ID 1: Process creation; alert on shred.exe, sdelete.exe, ccleaner.exe, bcdwipe.exe.
• Sysmon Event ID 4656/4663: File permission changes followed by deletion.
• Sigma rule: sigma/rules/windows/audit_log_cleared.yml (Event ID 1102).
• YARA: Memory scanning for known timestomp / logtamper signatures.

Defense Evasion Techniques

Sophisticated Timestamp Manipulation

• Both $STANDARD_INFO and $FILE_NAME: Update both NTFS timestamps to defeat timeline analysis (use setMACE over timestomp).
• Nanosecond precision matching: Match legitimate file nanosecond jitter to avoid statistical detection.
• USN Journal cleaning: Use fsutil usn deletejournal to remove update sequence number journal before timestomping.
• $LogFile overwrite: Overwrite NTFS transaction log to remove rollback records.
• MFT entry slack: Hide data in MFT slack space (up to 1024 bytes per entry).

Log Cleaning Beyond Simple Clearing

• Selective log entry removal: Use logtamper to remove specific entries matching engagement IP/user without clearing the entire log.
• Journal spam before deletion: Fill systemd-journald with synthetic events to push real entries past retention limit.
• Auditd configuration reload: auditctl -D to delete rules temporarily; restore after operations.
• Forwarded log poisoning: Modify syslog forwarding rules to drop specific entries before they reach SIEM.
• NTFS USN journal sparse: Sparse-allocate USN journal to make entries appear unreferenced.

Hidden Storage

• NTFS ADS persistence: Hide payloads in :Zone.Identifier or custom ADS; rarely inspected by AV.
• Volume boot record slack: Hide data in volume boot record slack space (fixed-size, ~32 KB).
• Hibernation file weaponization: Use hiberfil.sys for both hiding and persistence.
• Pagefile persistence: Hide payload in pagefile.sys; survives reboots.
• Steganography in unused drivers: Embed payload in .sys file slack space.
• MFT slack space: Hide up to 1024 bytes per file entry in MFT.

Memory-Resident Evasion

• Reflective DLL injection: Load DLL from memory without file on disk.
• Process doppelgänging: Use Transactional NTFS to load process from rolled-back file.
• Process hollowing + dual token: Hollow legitimate process AND inherit its token; combines identity theft with stealth.
• Hook NtQuerySystemInformation: Hide processes from ps, Task Manager, Get-Process.
• DKOM on handle table: Remove process handle from CSRSS; fully invisible to userland tools.

Anti-Memory Forensics

• Null out VAD tree: Manipulate Virtual Address Descriptors to hide memory regions from Volatility.
• Unlink EPROCESS: Disconnect process from active list; survives live response but caught by dead-box forensics.
• PteUAF: Use-after-free in page table entries to hide executable pages.
• Bypass Kernel Mode checks: Use vulnerable signed drivers (RTCore64.sys) to disable PatchGuard temporarily.

Learning Resources

This skill's supplementary files: payloads.md, test-cases.md, guides/filesystem-anti-forensics.md, guides/log-tamper-timestamp.md, guides/crypto-hide-data-destruction.md

Related skills:

• skills/digital-forensics/SKILL.md - The defensive counterpart covering forensic analysis that detects anti-forensic techniques
• skills/steganography/SKILL.md - Additional steganographic tools and detection methods
• skills/post-exploitation/SKILL.md - Persistence mechanisms that must be cleaned up using anti-forensic techniques

External resources:

• Anti-Forensics Techniques - HackTricks
• shred(1) Manual Page
• tcplay GitHub
• NIST SP 800-88 Rev. 1 - Guidelines for Media Sanitization
• SANS Anti-Forensics - SANS Institute research on anti-forensic techniques and detection