[Synchro]

Since I read a C HFI study guide, I have seen what power FBI's investigators have. So I decided to write an "anti-forensics" guide," I've seen only an "anonymity guide" with the same content proxies
VPN, TOR etc... but this can't protect you if you attack big companies and the FBI will get you without problems.

Lets start with the TUT

* Advice

Spoiler:

Delete your browsing information(cookies) with CCleaner
Use secure firewall and anti-virus (Comodo & Kaspersky is my favorite combination)
Use a key-scrambler
Don't register/own account in social networks like facebook,myspace....
Use CClear after every hacking activity - CCleaner tutorial

* Encrypt your computer and create hidden container

Spoiler:

For this step we will use TrueCrypt you can download it from here

1.Create a volume ( click the "create volume" button )
2 Now check "Create an encrypted file container "

3.Now click hidden TrueCrypt volume

4.Choose "Normal Mode"

5. Now click on "Select File"

Choose name for your volume
Click next

6.Choose encryption algorithm
7.Choose volume size
8.Now create password (I recommend to choose password that is easy to remember and encrypt it with base-64 esab-46 etc...)
9.Now click Format

Done !

* Create A Locked Screen Saver

Spoiler:

Encryption is pointless if the feds get to your computer while its running.

For Windows vista, 7 and 8 users
1. Right click you desktop and click on "Personalize"
2.In the left bottom corner you should see "Screen Saver"
3.Now check "On Resume, Display Logon Screen"
4. Now set "Wait" to 5 minutes

Done ! You have create secure screen saver

For Windows XP users
1.Open Control Panel
2.Click to ""Appearance and Themes " and then Display
3. Select "On Resume, password protect" check bow

Done !

* User assist file

Spoiler:

There is registry that keeps logs and dates of all launch programs you must disable this.

1.Open regedit (start - run - regedit)
2.Navigate 'HKEY_Current_User\Software\Microsoft\Windows\Currentvers ion\Explorer\Userassist' you will see two subkets called count delete both these keys now right click the userAssist key and create a new key named setting in this key create Dword value named NoLog the value to 1
Done ! Now Windows will no longer store hidden logs

* Last Access Logs

Spoiler:

Now we will disable the last access in Windows. Last access is a setting on Windows that allows you to see when you opened modigied and/or created files on your computer.

1. Open CMD (If you use vista, 7 or 8 make sure you run as administrator)
2. Type this command

Code:

fsutil behavior set disablelastaccess 1

3. Now reboot your system

Last access has now been disabled! Done !

* Windows Hibernation

Spoiler:

You may as well hand your computer over to the feds if they raid your house and your computer is in hibernation.

To disable hibernation in windows vista,7 or 8

1.Open Control panel
2.Click System and Security then click "Power Options"
3.Now click "Change plan settings"
4.Click "Change advanced power settings", expand "Sleep" than expand "Hibernate after" enter "0" for "Setting" and set hibernate to "Never"

Done !

* Disable and remove USB logs

Spoiler:

- Delete the USBSTOR registry setting
1.Open Regedit
2.Navigate "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR"
3.Right click "USBSTOR" and hit "Delete" the confirm that you what to delete the key

* Other anti-forensics techniques

Spoiler:

- Disable system restore points
1.Right click on "My Computer"
2.Click on properties
3.Now click ""Advanced system settings".
4.Click Configure
5. Now select "Turn of system protection" and apply it

- Disable Windows Event Logging
Windows keeps logs of all events on the computer first before we disable we must clear all the logs

1.Go to control panel
2.Now system and security
3.Click administrative tools and then even viewer
4.Right click system and then select "Clear all events"
5. Now will pop-up msg "Do you want to save 'System' before clearing it?" click NO

To disable event loggin
1.Open msconfig "start - run - mscongif"
2.Now go to "Serivces"
3.Make syre that ""Hide all Microsoft services" is UNCHECKED
4.Now scroll down until you find "Windows event loggin" and UNCHEK it
5.Reboot your system
Done !

-Disable debugging upon failure
This keeps logs of your computers failures and blue screen info
1.Right click on My Computer
2.Go to 'Advanced System Settings'
3.Now go to 'Start Up and Recovery'
4.Set 'Debugging Information' to 'None'
Done!

* Restrict Google

Spoiler:

Google keep cookies with information on what you have search. You can bypass this with tool called G-Zapper. You can download G-Zapper from softpedia it's free. Simple to use, install it, run it, click on delete cookies and then click on block google, you shoud be able ot use google search engine again but some services provide by Google may be blocked too.

* Browser anti-forensics

Spoiler:

Browsers keep history cookies and sometimes allow sites to collect information about you(for example flash plugins). But there is easy decision it's called TOR browser, it's very simple to use just run it, it will protect your privacy and anonymity and will try to don't leave any tracks on your PC. Download TOR browser

* Steganography

Spoiler:

In case that federal's get into the crypted hard dist

-What is steganography
Steganography is a technique where information or files are hidden within another file in an attempt to hide data by leaving it in plain sight steganography is good replica of cryptography.

steganography can be implemented on:
^Text file
^Images
^Audio
^Video
^Web content (protocols)

-Image based steganography
To understand the image based steganography we need to understand the concept of a digital image.
[/code]Images are the combination of width and hight (W*H) that becomes pixel images are based on 8-bit or 24-bit color combination, if we discuss about 8-bit color than there would 256 colors formed an image because of the basic binary calculation (2^8= 256). A 24-bit color pattern is more complex and provide more colors in this case each pixel represent 3 bytes remember 1 byte contain 8-bits and each byte represent a combination of color that is RGB (Red, Green and Blue). Let suppose an image has a size of 1200 * 800 pixel than 1200 x 800= 960,000 pixel so for 24-bit scheme that contain 3 bytes it would become 960,000 x 3 =28,80000 bytes and 1 byte consist of 8 bits so 2880000 x 8 = 23040000 bits[/code]
cwi-group.net

Now lets say that we have 2 files first is antagonism-logo.jpge and second one is paypal-details.txt
1. Compress the txt file (paypal-details.txt)(zip, 7z...)
2. Open CMD and navigate the folder with the files
3. Type this command

Code:

copy /b the_image + rar_file_to_hide image_result_name In my case : copy /b antagonism-logo.jpge + paypal-details.zip steganography.jpge

To open the zip file just change the extension .jpge to .zip

* Crypting files

Spoiler:

This will be very nice combination with steganography
You will need easy crypter

Code:

2512-1972-2954

cd key

1.Open easy crypter
2.Click on encrypt file
3.Choose file
4.Make strong password(again something easy to remember with encryption base-64 for example see crypo.org)
5.Re-write the password

! Done now if you try to open it nothing will happen

To open it just click on decrypt button and write the password

Blackhat Europe 2010: Steganography and Vulnerabilities in Popular Archives Formats

Spoiler:

Part 1

Spoiler:

Part 2

Spoiler:

Part 3

Spoiler:

Part 4

Spoiler:

Part 5

Spoiler:

Part 6

Spoiler:

Part 7

Spoiler:

Part 8

Spoiler:

Occult computing class (Anti-forensics)

Spoiler:

I found this in internet its 3 hours long and there is much information

DEFCOM 20 Anti-Forensics And Anti-Anti-Forensics: Attacks And Mitigating Techniques For Digital-Forensic Investigations

Spoiler:

I will continue updating this guide

Since, INST1NCT request little information about this, I decide to search for something
I'm not very good with Linux forensics but I think this information is legit

Backtrack 4 R2 Digital Forensics Scrub

Spoiler:

Backtrack 4 R2 Digital Forensics Wipe

Spoiler:

Backtrack 4 R2 Digital Forensics Magicrescue

Spoiler:

Backtrack 4 R2 Digital Forensics Foremost

Spoiler:

Backtrack 4 R2 Digital Forensics Allin1

Spoiler:

Backtrack 4 R2 Digital Forensics Autopsy - Case Management

Spoiler:

Backtrack 5 Gnome - TrueCrypt

Spoiler:

Backtrack 5 Gnome - HexEdit

Spoiler:

Backtrack 5 Gnome - Exiftool

Spoiler:

Backtrack 5 Gnome - hashdeep

Spoiler:

Ubuntu CD/DVD Encryption

Spoiler:

Hope this is enough for now I will continue updating and adding information!
Please write a comment positive or negative to keep this thread alive

[Deque]

Since I read a C HFI study guide, I have seen what power FBI's investigators have. So I decided to write an "anti-forensics" guide," I've seen only an "anonymity guide" with the same content proxies
VPN, TOR etc... but this can't protect you if you attack big companies and the FBI will get you without problems

Please note, that this is an ethical hacking forum. So there shouldn't be any need to protect yourself from FBI.

Nevertheless good tutorial. Keep going.

Something funny in the end your tutorial reminded me of:

[Synchro]

Well let's say that this is for investigator to see what techniques may hackers use, like pen testers learn techniques for hackers.

[TheBlackWalker]

I love the tutorial. Thanks!