Windows 7 Antiforensics: A Review and a Novel Approach

Abstract

In this paper, we review literature on antiforensics published between 2010 and 2016 and reveal the surprising lack of up-to-date research on this topic. This research aims to contribute to this knowledge gap by investigating different antiforensic techniques for devices running Windows 7, one of the most popular operating systems. An approach which allows for removal or obfuscation of most forensic evidence is then presented. Using the Trojan software DarkComet RAT as a case study, we demonstrate the utility of our approach and that a Trojan Horse infection may be a legitimate possibility, even if there is no evidence of an infection on a seized computer's hard drive. Up-to-date information regarding how forensic artifacts can be compromised will allow relevant stakeholders to make informed decisions when deciding the outcome of legal cases involving digital evidence.

Systematic Review: Anti-Forensic Computer Techniques

“…Eterovic-Soric et al [172] point out the paucity of research on techniques that hinder digital forensic analysis of electronic devices, focusing specifically on Windows 7 computers. They propose a method that removes or hides much of the digital evidence that forensic analysts typically use in their investigations.…”

“…Article [171] focuses on anti-forensics techniques for swap files, proposing two methods: fake data injection and creation of fake swap files. Article [172] discusses the lack of recent research on anti-forensics and proposes a general approach to hiding evidence on Windows 7 systems using Trojan software.…”

“…As novel contributions, article [171] proposes two specific anti-forensics techniques for swap files, an area that has been little studied; on the other hand, article [172] highlights the need for updated research on anti-forensic techniques for operating systems.…”