Forensic analysis of anti‐forensic file‐wiping tools on Windows

Abstract

This paper presents forensic analysis of anti‐forensic file‐wiping tools on the Windows platform. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. We also analyzed Registry keys and .lnk files to collect the evidence. Our experiments used four file‐wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them. We also found that the contents of resident and non‐resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.

A reference database of Windows artifacts for file‐wiping tool execution analysis

“…Open&SavePidlMRU is an artifact that contains information about files that have been opened or saved by an application [7]. We determined that Open&SavePidlMRU could potentially have traces of file-wiping tools as it also saves records of exe files.…”

“…LastVisitedPidlMRU artifact provides information about the application used to view or store files in Open&SavePidlMRU, as well as the locations of files that were previously accessed by those applications [7]. Therefore, it can be determined that if a file-wiping tool was used, traces of it may remain in this artifact.…”

“…LNK file is a shell item which automatically generated by the Windows OS as a result of the execution of the file or folder such as an application's executable file, document, or image. They contain information such as the name, size, and location accessed file [7]. If the lnk file of a file‐wiping tool remains, it can be assumed that the program was executed, so we decided to consider it in our study.…”

“…Previous studies have attempted to detect wiping traces by analyzing remaining artifacts or changes in data areas after wiping [7–10]. These studies have made significant contributions, but there are limitations when dealing with new wiping tools or analyzing new artifacts.…”

A Digital Forensic View of Windows 10 Notifications

“…For example, an email client toast notification might hold data and metadata-sender, date/time-about incoming emails. Although the amount of data are limited, it might be useful when common forensic artifacts have provided no valuable data, or the machine was cleaned with anti-forensic software [5,6]. Additional details about anti-forensic software are presented in Section 3.1.…”