Digital forensics is vital in responding to cybersecurity threats and incidents by enabling investigators to identify, collect, and analyze digital evidence. As cyberattacks become increasingly sophisticated, adversaries leverage anti-forensic techniques to evade detection and hinder forensic investigations. These techniques aim to remove, obfuscate, or manipulate digital traces, thereby reducing the effectiveness of forensic analysis. Despite growing interest in anti-forensics, limited attention has been given to systematically evaluating their real-world impact. In this paper, we investigate the effects of selected anti-forensic techniques, such as file deletion, log deletion, data hiding in alternate data streams (ADS), encryption, fake evidence creation, and timestamp manipulation, on two critical aspects: the integrity and availability of digital traces, and the accuracy of algorithmic anomaly detection in data-driven forensic analysis. Our study is guided by two primary research questions: (1) How can the impact of anti-forensic techniques on specific digital artifacts and anomaly detection accuracy be quantified? (2) What is the measurable effect of selected anti-forensic techniques on the quality and reliability of forensic investigations? To address these questions, we propose a methodology based on impact levels and an impact matrix supported by quantitative evaluation using precision, recall, and F1 score. Experiments were conducted using a Windows operating system with an NTFS filesystem.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

The Impact of Anti-forensic Techniques on Data-Driven Digital Forensics: Anomaly Detection Case Study

  • Zuzana Hennelová,
  • Eva Marková,
  • Pavol Sokol

摘要

Digital forensics is vital in responding to cybersecurity threats and incidents by enabling investigators to identify, collect, and analyze digital evidence. As cyberattacks become increasingly sophisticated, adversaries leverage anti-forensic techniques to evade detection and hinder forensic investigations. These techniques aim to remove, obfuscate, or manipulate digital traces, thereby reducing the effectiveness of forensic analysis. Despite growing interest in anti-forensics, limited attention has been given to systematically evaluating their real-world impact. In this paper, we investigate the effects of selected anti-forensic techniques, such as file deletion, log deletion, data hiding in alternate data streams (ADS), encryption, fake evidence creation, and timestamp manipulation, on two critical aspects: the integrity and availability of digital traces, and the accuracy of algorithmic anomaly detection in data-driven forensic analysis. Our study is guided by two primary research questions: (1) How can the impact of anti-forensic techniques on specific digital artifacts and anomaly detection accuracy be quantified? (2) What is the measurable effect of selected anti-forensic techniques on the quality and reliability of forensic investigations? To address these questions, we propose a methodology based on impact levels and an impact matrix supported by quantitative evaluation using precision, recall, and F1 score. Experiments were conducted using a Windows operating system with an NTFS filesystem.