Page 1

ANTI - FORENSICS · A GUIDE FOR UK LAWYERS File Wiping, Anti-Forensics and the Evidence They Leave Behind When the Attempt to Destroy Evidence Becomes the Evidence COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANTI-FORENSICS EXAM IN AT I ON

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: destruction is an act, and acts are recorded 03 The techniques: wiping, cleaning, encryption, resets and obfuscation 04 The traces: installation, execution, patterns and the negative space 05 Mobile, cloud and platform anti-forensics 06 What survives: the honest limits of recovery and the estate's redundancy 07 Deployment: timing, intent and the consequences of proven destruction 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ANTI - FORENSICSDESTROYSCONTENTANDCREATESEVIDENCE OFDESTRUCTION: THEEXAMINATIONREADSTHETOOL, THEEXECUTION, THEEXTENT ANDTHETIMING, STATESHONESTLYWHATISGONE, ANDLETSTHECOURTDRAWTHE INFERENCETHATDELIBERATEDESTRUCTIONAFTERADUTYAROSEINVITES

§ 02 · FIRST PRINCIPLES The problem in plain English: destruction is an act, and acts are recorded

§ 03 · THETECHNIQUES The techniques: wiping, cleaning, encryption, resets and obfuscation