Explain what "anti-forensics" is, and provide detail on some anti-forensics tactics.

Question

What will be an ideal response?

Answer 1

ANSWER: Destroying ESI that’s potential evidence is called “anti-forensics.” Anti-forensics tactics are used in cloud environments as well as in other network environments. Hackers might obfuscate incriminating files or hide them by the simple technique of changing file extensions. Specialized malware for defeating evidence collection can add time to an investigation and result in the loss of valuable evidence. Additional methods for anti-forensics include inserting malware programs in other files, using encryption to obfuscate malware programs activated through other malware programs, and using data-hiding utilities that append malware to existing files. Other techniques affect file metadata by changing the modify and last access times. Changing file timestamps can make it difficult to develop a timeline of a hacker’s activities.