Page 1
ANTI - FORENSICS · A GUIDE FOR UK LAWYERS File Wiping, Anti-Forensics and the Evidence They Leave Behind When the Attempt to Destroy Evidence Becomes the Evidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANTI-FORENSICS EXAM IN AT I ON
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: destruction is an act, and acts are recorded 03 The techniques: wiping, cleaning, encryption, resets and obfuscation 04 The traces: installation, execution, patterns and the negative space 05 Mobile, cloud and platform anti-forensics 06 What survives: the honest limits of recovery and the estate's redundancy 07 Deployment: timing, intent and the consequences of proven destruction 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ANTI - FORENSICSDESTROYSCONTENTANDCREATESEVIDENCE OFDESTRUCTION: THEEXAMINATIONREADSTHETOOL, THEEXECUTION, THEEXTENT ANDTHETIMING, STATESHONESTLYWHATISGONE, ANDLETSTHECOURTDRAWTHE INFERENCETHATDELIBERATEDESTRUCTIONAFTERADUTYAROSEINVITES
§ 02 · FIRST PRINCIPLES The problem in plain English: destruction is an act, and acts are recorded
§ 03 · THETECHNIQUES The techniques: wiping, cleaning, encryption, resets and obfuscation
Page 2
§ 04 · THETRACES The traces: installation, execution, patterns and the negative space
§ 05 · MOBILE, CLOUD AND PLATFORM AN TI-FORENSICS Mobile, cloud and platform anti-forensics
§ 06 · WHATSURVIVES What survives: the honest limits of recovery and the estate's redundancy
§ 07 · DEPLOYMENT Deployment: timing, intent and the consequences of proven destruction
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION AUDIT + + PHYSICAL + SHADOW DEVICE ESTATE WIPED / ARTEFACTS REDUNDANCY UNRECOVERABLE PLATFORM BEHAVIOURAL JOURNALS RECORDS LAYER COPIES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEFREE - SPACEWIPEANDTHESEARCHTHATPRECEDEDIT EXAMPLE2 · THEPHONERESETTHENIGHTBEFOREHANDOVER EXAMPLE3 · THECLEANERTHATWASROUTINE, ANDTHEALLEGATIONTHATFAILED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ANTI - FORENSICS PA R AG RAPHFORAHOLDNOTICE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The anti-forensics checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The other side's laptop is completely empty. Can anything be recovered? Can an expert tell the difference between routine clean-up and deliberate destruction? A phone was factory-reset before h and over. Is the evidence gone? What if the data was encrypted rather than wiped? How should we warn a client not to do any of this? Is running a wiping tool a criminal offence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, File Wiping Anti Forensics And The Evidence They Leave Behind, Computer Forensics Lab, https://e-discovery.uk/library/file-wiping-anti-forensics-and-the-evidence-they-leave-behind/pdf.