Privacy Preserving Anti-forensic Techniques

Wani, Mohamad Ahtisham

doi:10.1007/978-981-15-8711-5_5

Cited by 4 publications

(3 citation statements)

References 85 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the offender could modify evidence of interest by deleting, editing, and clearing messages on the cache. The action is anti-forensics -data concealment by implementing data hiding and trail obfuscation techniques to remain anonymous or undetected [11], [12]. In addition to antiforensic issues, it could lead to incomplete attributes of collected artifacts and affect the integrity of digital evidence [13].…”

Section: Introductionmentioning

confidence: 99%

Proactive Acquisition using Bot on Discord

Cahyani¹,

Pratama²,

Rahman³

2023

IJACSA

View full text Add to dashboard Cite

Data deletion increases challenges in cybercrime investigation. To address the problem, proactive forensics for evidentiary collection is acknowledged to help investigators to acquire the potentially needed digital evidence. This study proposes a bot machine to record data from the Discord server in advance, hashing and saving it in proper storage for further forensic analysis. The recording process can be managed to collect activities and their related data (intact, modified, deleted), including text, pictures, videos, and audio. The Discord bot is designed by utilizing the main features of the Discord Social Networks Application Programming Interface (API). This paper examines how this approach is applicable by embedding the bot in a Discord server. Observation showed that the bot records the real-time data as it is always alive on the server, including the deleted or modified messages and their timestamps. All the recorded data is saved locally on the server's storage in easy-toread formats, CSV and JSON. The results showed that the bot could conduct the data acquisition for 37 concurrent users with a 2.3% error rate and 97.7% accuracy.

show abstract

Section: Introductionmentioning

confidence: 99%

Proactive Acquisition using Bot on Discord

Cahyani¹,

Pratama²,

Rahman³

2023

IJACSA

View full text Add to dashboard Cite

show abstract

“…Among many anti-forensic attacks, file wiping is the most common anti-forensic attack in which a file is completely overwritten by some random data [3]. File wiping aims to ensure that any forensic effort to recover the wiped file (both data and metadata) is rendered useless [4]. However, file wiping has faced controversial opinions in digital forensics on the required number of passes for complete overwriting [5].…”

Section: Introductionmentioning

confidence: 99%

“…Moreover, a recent study has demonstrated that a single wipe procedure is enough to make any reasonable data recovery impossible in modern magnetic drives [9]. Since file wiping is also commonly used for protecting privacy [4], many tools are available for free across all the platforms for wiping data. Also, transparent-per-file wiping extensions have been proposed, and are available both as purging extensions to the library and as stackable file systems [10,11].…”

Section: Introductionmentioning

confidence: 99%

Forensic analysis of anti‐forensic file‐wiping tools on Windows

AlHarbi

Alzahrani

Bhat

2021

Journal of Forensic Sciences

View full text Add to dashboard Cite

This paper presents forensic analysis of anti‐forensic file‐wiping tools on the Windows platform. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. We also analyzed Registry keys and .lnk files to collect the evidence. Our experiments used four file‐wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them. We also found that the contents of resident and non‐resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.

show abstract

File system to support secure cloud-based sharing

Yamamoto

Hirotsu

2022

2022 IEEE Intl Conf on Parallel &Amp; Distributed Processing With Applications, Big Data &Amp; Cloud Computing, Sustainable Com

View full text Add to dashboard Cite

Privacy Preserving Anti-forensic Techniques

Cited by 4 publications

References 85 publications

Proactive Acquisition using Bot on Discord

Proactive Acquisition using Bot on Discord

Forensic analysis of anti‐forensic file‐wiping tools on Windows

File system to support secure cloud-based sharing

Contact Info

Product

Resources

About