Basic anti-forensics 10-01-2012, 10:51 PM
#1
Anti-forensics is the art of hiding, encrypting and trace covering. Despite what the name might suggest, those techniques are not only countermeasures to investigative analysis of data done by the police - those are also valid defenses against attackers - both hackers trying to access your data remotely and people with physical access to your computers trying to spy on you.
Anti-fornesics are divided into four basic categories: data hiding, artifact wiping, trail obfuscation and attacks against forensic tools. The last category is beyond the scope of this post as it requires extensive knowledge of forensic tools and solid knowledge of hacking/cracking software (crafting special files that will crash the application or cause errors on attacker's system is a central part of this category).
Data hiding
Data hiding falls into two separate categories: cryptography and steganography. The idea of cryptography is to hide content of the data while steganography seeks to hide the very existence of it.
To secure your data cryptographically, you need to encrypt it with a cypher. Cyphers can be symmetric (i.e. Enigma, rot13 - entering message X gives you cyphertext Y and vice versa) or asymmetric (most of modern ciphers are asymmetric - you use public key to encrypt the message and private key to decrypt the cyphertext).
Steganography hides the existence of data, which in the context of computer security means things like hiding files inside other files, hiding files in secret catalogs (there are even a few on every Windows, google it) or hiding files in 'slackspace'.
If you want to encrypt your e-mails, I suggest using PGP which gives you some nice asymmetric ciphers. If you want to hide stuff on your disk (or other storage media), I suggest TrueCrypt which has both cryptography (encrypting files or even the whole HDD) and steganography (containers inside containers, hidden operating system) features. It's generally a very reliable program and, if used correctly, extremely difficult to break - even by law enforcement.
Artifact wiping
Due to the way the HDD, the filesystems and operating systems work, a file that was simply deleted is not gone for good. At first it's actually still there, just inaccessible through normal means. Then, as its space on HDD gets overwritten, it disappears - but the traces still remain for quite a long time (although they 'decay' gradually).
There are three ways of permanently destroying the data: wiping, degaussing and physical destruction of the drive.
Wiping can be done to single files as well as to whole partitions or disks. It works by deleting the data, then repeatedly overwriting it with 1s, 0s, patterns of 1s and 0s or randomly generated combinations. Specific methods of wiping depend on type of the drive, desired level of secrecy and available time. Usually, shorter methods with 3-4 overwrites are enough, although if you're paraoid you can use the good old Gutmann method with its 35 overwrites. To wipe whole disk, I suggest using KillDisk. To wipe single files/catalogs, I suggest Eraser.
Degaussing uses a strong magnet to wipe the data stored on HDD. It's basically foolproof, with just one problem - the magnet can damage some parts of the disk. While it's possible to repair them, it's usually cheaper to just buy a new one.
Physical destruction is self-explanatory. You render your disk completely unusable in process, of course. If done badly, it might still be possible to recover the data so be sure to destroy the platters if you go this way, or just kill it with fire.
Trail obfuscation
Trails obfuscation can be divided into modification of metadata, anonymization and trace covering. Anonymization (proxies, VPNs, MAC spoofing) and trace covering (erasing logs etc.) will not be described here as they are the core concepts of hacking and you'll find plenty of info about them here.
Modification of metadata involves changing file parameters that might directly or indirectly disclose your involvement. The first ones are the easiest to change as they usually aren't hidden that well - those are, for example, EXIFs containing serial numbers, author names and geotags. The indirect ones usually relate to timestamps (time of creation and modificaton). Use Timestomp to pwn them.
Anti-anti-forensics
Even the best implementation of all the anti-forensics tools and techniques won't help you with one simple thing: spyware. If you're infected with a keylogger or a virus that takes screenshots or a RAT, you're just wasting time with them. Thus, succesful anti-forensics require either good anti-virus or such working environment that makes infection extremely difficult (i.e. obscure OS).
Anti-fornesics are divided into four basic categories: data hiding, artifact wiping, trail obfuscation and attacks against forensic tools. The last category is beyond the scope of this post as it requires extensive knowledge of forensic tools and solid knowledge of hacking/cracking software (crafting special files that will crash the application or cause errors on attacker's system is a central part of this category).
Data hiding
Data hiding falls into two separate categories: cryptography and steganography. The idea of cryptography is to hide content of the data while steganography seeks to hide the very existence of it.
To secure your data cryptographically, you need to encrypt it with a cypher. Cyphers can be symmetric (i.e. Enigma, rot13 - entering message X gives you cyphertext Y and vice versa) or asymmetric (most of modern ciphers are asymmetric - you use public key to encrypt the message and private key to decrypt the cyphertext).
Steganography hides the existence of data, which in the context of computer security means things like hiding files inside other files, hiding files in secret catalogs (there are even a few on every Windows, google it) or hiding files in 'slackspace'.
If you want to encrypt your e-mails, I suggest using PGP which gives you some nice asymmetric ciphers. If you want to hide stuff on your disk (or other storage media), I suggest TrueCrypt which has both cryptography (encrypting files or even the whole HDD) and steganography (containers inside containers, hidden operating system) features. It's generally a very reliable program and, if used correctly, extremely difficult to break - even by law enforcement.
Artifact wiping
Due to the way the HDD, the filesystems and operating systems work, a file that was simply deleted is not gone for good. At first it's actually still there, just inaccessible through normal means. Then, as its space on HDD gets overwritten, it disappears - but the traces still remain for quite a long time (although they 'decay' gradually).
There are three ways of permanently destroying the data: wiping, degaussing and physical destruction of the drive.
Wiping can be done to single files as well as to whole partitions or disks. It works by deleting the data, then repeatedly overwriting it with 1s, 0s, patterns of 1s and 0s or randomly generated combinations. Specific methods of wiping depend on type of the drive, desired level of secrecy and available time. Usually, shorter methods with 3-4 overwrites are enough, although if you're paraoid you can use the good old Gutmann method with its 35 overwrites. To wipe whole disk, I suggest using KillDisk. To wipe single files/catalogs, I suggest Eraser.
Degaussing uses a strong magnet to wipe the data stored on HDD. It's basically foolproof, with just one problem - the magnet can damage some parts of the disk. While it's possible to repair them, it's usually cheaper to just buy a new one.
Physical destruction is self-explanatory. You render your disk completely unusable in process, of course. If done badly, it might still be possible to recover the data so be sure to destroy the platters if you go this way, or just kill it with fire.
Trail obfuscation
Trails obfuscation can be divided into modification of metadata, anonymization and trace covering. Anonymization (proxies, VPNs, MAC spoofing) and trace covering (erasing logs etc.) will not be described here as they are the core concepts of hacking and you'll find plenty of info about them here.
Modification of metadata involves changing file parameters that might directly or indirectly disclose your involvement. The first ones are the easiest to change as they usually aren't hidden that well - those are, for example, EXIFs containing serial numbers, author names and geotags. The indirect ones usually relate to timestamps (time of creation and modificaton). Use Timestomp to pwn them.
Anti-anti-forensics
Even the best implementation of all the anti-forensics tools and techniques won't help you with one simple thing: spyware. If you're infected with a keylogger or a virus that takes screenshots or a RAT, you're just wasting time with them. Thus, succesful anti-forensics require either good anti-virus or such working environment that makes infection extremely difficult (i.e. obscure OS).
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
