File Wiping Anti Forensics And The Evidence They Leave Behind

ANTI - FORENSICS · AGUIDEFORUKLAWYERS File Wiping, Anti-Forensics and the Evidence They Leave Behind When the Attempt to Destroy Evidence Becomes the Evidence COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANTI-FORENSICS EXAMINATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: destruction is an act, and acts are recorded 03 The techniques: wiping, cleaning, encryption, resets and obfuscation 04 The traces: installation, execution, patterns and the negative space 05 Mobile, cloud and platform anti-forensics 06 What survives: the honest limits of recovery and the estate's redundancy 07 Deployment: timing, intent and the consequences of proven destruction 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ANTI - FORENSICSDESTROYSCONTENTANDCREATESEVIDENCE OFDESTRUCTION : THEEXAMINATIONREADSTHETOOL , THEEXECUTION , THEEXTENT ANDTHETIMING , STATESHONESTLYWHATISGONE , ANDLETSTHECOURTDRAWTHE INFERENCETHATDELIBERATEDESTRUCTIONAFTERADUTYAROSEINVITES § 0 2 · FIRSTPRINCIPLES The problem in plain English: destruction is an act, and acts are recorded § 0 3 · THETECHNIQUES The techniques: wiping, cleaning, encryption, resets and obfuscation § 0 4 · THETRACES The traces: installation, execution, patterns and the negative space § 0 5 · MOBILE , CLOUDANDPLATFORMANTI - FORENSICS Mobile, cloud and platform anti-forensics § 0 6 · WHATSURVIVES What survives: the honest limits of recovery and the estate's redundancy § 0 7 · DEPLOYMENT Deployment: timing, intent and the consequences of proven destruction § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION AUDIT + + PHYSICAL + SHADOW DEVICE ESTATE WIPED / ARTEFACTS REDUNDANCY UNRECOVERABLE PLATFORM BEHAVIOURAL JOURNALS RECORDS LAYER COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEFREE - SPACEWIPEANDTHESEARCHTHATPRECEDEDIT EXAMPLE2 · THEPHONERESETTHENIGHTBEFOREHANDOVER EXAMPLE3 · THECLEANERTHATWASROUTINE , ANDTHEALLEGATIONTHATFAILED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · ANTI - FORENSICS PA R AG RAPHFORAHOLDNOTICE § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The anti-forensics checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The other side's laptop is completely empty. Can anything be recovered? Can an expert tell the difference between routine clean-up and deliberate destruction? A phone was factory-reset before handover. Is the evidence gone? What if the data was encrypted rather than wiped? How should we warn a client not to do any of this? Is running a wiping tool a criminal offence? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY