Not every device reaches analysis in the state in which it was used. Sometimes someone has tried to delete, hide or alter the traces. Techniques meant to hinder an analysis are called anti-forensics. This article does not explain how to use them, but how an analyst recognises them: almost every attempt at concealment leaves traces of its own, and sometimes those traces say more than what was meant to be hidden.
A basic principle
Every action on a system has effects. Deleting, overwriting, changing a date or clearing a log are actions like any other: they require programs, commands and time, and they leave marks in places the person acting does not know about or cannot reach. The analyst's goal is not only to look for what is missing, but to notice the anomalies that its absence has produced.
The main families of techniques and their signs
Secure file deletion
Secure-deletion programs overwrite file content before deleting it. The content is lost, but often what remains is:
- traces of the program's execution in system artifacts;
- recent-file shortcuts pointing to files that no longer exist;
- file system entries with random or repetitive names, typical of some tools;
- areas of the drive filled uniformly, unlike the normal noise of deleted data.
Timestamp alteration
Changing a file's dates, so-called timestomping, is meant to make it look older or newer. On some file systems, such as NTFS, each file has several sets of dates stored in different structures, and common tools change only some of them. An inconsistency between these sets, or dates with unusually "round" precision, are typical signs. A file with a very old date in a recently created folder also deserves attention.
Log clearing
Clearing event logs or server logs is a common way to hide an intrusion. But:
- on Windows, clearing a log normally generates a specific event;
- a log that suddenly starts at a recent date, on a system in use for years, is abnormal;
- time gaps in normally continuous logs indicate interruptions;
- logs sent to external systems remain intact.
System reinstallation or reset
A computer formatted and reinstalled a few days before being handed over is itself a fact. The operating system installation date is recorded and can be compared with the events in the case. The same applies to a phone reset to factory settings: the data on the device disappears, but backups, cloud accounts and linked devices may keep traces of it.
Non-persistent systems or browsers
Operating systems booted from a USB stick and designed to leave no traces, or private browsing, reduce local information. Indirect clues remain, though: the USB device connection, firmware settings for booting from external media, router logs.
Data hiding
Data hidden in innocent-looking files, changed extensions, encrypted containers. Useful signs:
- files whose extension does not match their real content, detectable by checking the format signature;
- very large files with apparently random content;
- images larger than you would expect for their resolution.
A summary table
| Technique | What is lost | What often remains |
|---|---|---|
| Secure deletion | File content | Program execution, orphaned shortcuts |
| Timestamp alteration | Reliable dates on a file | Inconsistencies between date sets |
| Log clearing | Local events | Clearing event, external logs |
| Reinstallation | Local data | Installation date, cloud, backups |
| Data hiding | Immediate visibility | Inconsistent format signatures |
How to interpret these signs
Recognising anti-forensic activity does not automatically prove wrongdoing. There are legitimate reasons to securely wipe a drive before selling it, to reinstall a slow system, to use encryption. The analyst must describe what was observed, place it in time and compare it with the context. Secure deletion carried out the evening before returning a company computer carries a different weight from periodic clean-up configured years ago.
Prevention in organisations
Many anti-forensic techniques become ineffective if important data also exists elsewhere. Logs sent in real time to a central system, IT-managed backups, cloud service audit logs and policies preventing the installation of unauthorised programs make it much harder to make traces disappear.
In short
- Almost every concealment attempt leaves traces of its own.
- Secure deletion, altered dates and cleared logs have recognisable signs.
- A recent reinstallation is a fact to be placed in time.
- Recognising anti-forensic activity is not the same as proving wrongdoing.
- Centralised logs and independent backups reduce the effectiveness of these techniques.