Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and reactive measures. Diverse and realistic datasets that reflect anti-forensic measures a...
详细信息
Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and reactive measures. Diverse and realistic datasets that reflect anti-forensic measures are needed to validate digital forensic tools and advance digital forensics education and research. However, datasets are increasingly created in a synthetic manner due to privacy and legal constraints. The work described in this chapter contributes to improving the digital forensic process by assessing anti-forensic measures at the filesystem level and providing a means for synthesizing datasets containing anti-forensic artifacts. Specifically, it provides an in-depth analysis of anti-forensic data hiding techniques in the evolving Linux-based b-tree filesystem (btrfs). Also, it presents a methodology for generating anti-forensic traces at the filesystem level in a post mortem storage device dataset. The methodology links the ForTrace data synthesis framework and fishy anti-forensic data hiding framework. A data synthesis tool is developed for generating anti-forensic data hiding traces for three common filesystems, NTFS, ext4 and btrfs, and providing essential data synthesis functionality to simulate the expected behavior of the operating system. Additionally, a validation model comprising three complexity levels is presented for assessing the implemented anti-forensic data hiding techniques. Overall, the research provides a powerful approach for generating datasets that reflect anti-forensic artifacts potentially used by attackers.
暂无评论