GCFA · Domain 4
Anti-Forensics Detection
About 25% of the exam
Anti-forensics families
- Destruction
- wiping, log clearing, shadow deletion
- Hiding
- streams, slack, hidden drive areas
- Obfuscation
- packing, encryption, name masquerading
- Falsification
- timestomping and forged records
- Prevention
- blinding sensors before acting
- Trail dilution
- noise that buries the real events
Every anti-forensic action is itself an action, and actions leave their own artifacts
Log tampering
- Security log cleared is itself an event
- The System log records the clearing too
- A silent log source is suspicious
- Tracing patched in memory stops telemetry
- Script logging disabled through the registry
- Forwarded copies survive local deletion
Timestamp falsification
- Standard information times are trivially rewritten
- Index times usually keep the truth
- Zeroed sub-seconds betray a tool
- Journal ordering ignores forged times
- Compile time contradicts a young creation stamp
- Neighbors on disk give the real baseline
Wiping and secure delete
- Single pass
- enough on modern magnetic media
- Pattern fill
- repeating bytes suggest a tool
- File wipe
- content gone, record may survive
- Free space wipe
- unallocated recovery becomes hopeless
- Drive trim
- solid state cells cleared early
- Secure erase
- firmware command, whole device
- Crypto erase
- destroy the key, not the data
Where data hides
File system tricks
- Alternate data streams on ordinary files
- File slack after the logical end
- Extension changed to mislead sorting
- Very long or reserved names
Below the file system
- Host protected area hides sectors
- Device configuration overlay shrinks capacity
- Unpartitioned gaps between volumes
- Boot record and partition table slack
Inside content
- Steganography inside images and audio
- Payload appended after the end marker
- Encrypted containers with no header signature
- Archives nested to defeat scanners
Compare reported capacity against native capacity; a shrunken drive is often a hiding place
Masquerading and process abuse
- System name running from a user directory
- Signed application loading an unsigned module
- Renamed copies of trusted binaries
- Living off the land tools instead of malware
- Parent process identifier spoofed at creation
- Service names that mimic real ones
Fileless persistence
- WMI subscription
- filter, consumer and binding trio
- Registry payload
- encoded script stored in a value
- Scheduled task
- encoded command inside the action
- Startup shortcut
- launcher hidden in a folder
- Search order hijack
- module found before the real one
- Reflective load
- code never written to disk
Detecting injection on disk and memory
- Executable private memory with no file
- Image in memory differs from disk
- Module loaded from a world writable path
- Handle opened against the credential service
- Driver loaded from a temporary directory
- Confirm with a second independent artifact
Anti-recovery in ransomware
- Shadow copies deleted before encryption
- Backup catalogs and agents removed
- Recovery environment disabled
- Event logs cleared at the end
- Mass rename within a few minutes
- Note dropped into every directory
The destruction sequence is itself a timeline, and its first step dates the operator decision
Residue the attacker forgets
Execution residue
- Prefetch survives the deleted binary
- Amcache keeps the hash and path
- Background activity keys record the run
- Resource monitoring keeps the bytes sent
File system residue
- Change journal names deleted files
- Transaction log holds recent operations
- Shadow copies predate the cleanup
- Index slack retains removed entries
Off-host residue
- Forwarded logs in the collector
- Proxy and firewall connection records
- Endpoint telemetry in the cloud console
- Mail and identity provider audit logs
Cleanup is local; the copies that already left the host are what defeat it
Encryption and containers
- Volume header signatures identify the scheme
- Headerless containers look like random data
- Uniform high entropy suggests encryption
- Capture memory while the volume is mounted
- Look for recovery keys in directory services
- Hibernation and swap may hold keys
Reporting negative findings
- Say which artifacts were checked and empty
- Distinguish absence from destruction
- Quantify what wiping actually removed
- Record the tool signature you observed
- Never overstate intent from a deletion
- Explain what could still be recovered
Key artifacts
- Event 1102
- security log cleared
- Event 104
- a log was cleared
- Shadow copy deletion
- administrative command in process history
- Change journal
- deletions and renames with reasons
- Alternate stream
- content hidden on a normal file
- Hidden drive area
- capacity mismatch on the device
- Wipe pattern
- repeating bytes across free space
Know the order
- Notice the gap
- Prove the gap is deliberate
- Find the residue elsewhere
- Date the cleanup itself
- Report scope and limits
Treat the cleanup as an event with a time, an account and a tool, then place it in the timeline
Reference strip: anti-forensics quick map
Destroy
- Log clearing and telemetry blinding
- Shadow copy and backup deletion
- File and free space wiping
- Firmware level secure erase
Hide
- Alternate data streams and slack
- Host protected area and overlay
- Steganography and appended payloads
- Encrypted headerless containers
Deceive
- Timestomping and rounded values
- Masquerading process names
- Spoofed parent process identifiers
- Forged or injected log entries
Detect
- Compare two enumeration methods
- Index times against standard times
- Capacity reported against native
- Entropy and signature mismatches
Survive
- Forwarded and cloud held logs
- Shadow copies and backups
- Change journal and transaction log
- Network and identity provider records
Quick exam traps
- Trap: Wiped free space means nothing can be recovered
- Trap: Clearing the security log leaves no record of the clearing
- Trap: Any deleted file was deleted to hide something
- Trap: Encrypted volumes make memory capture pointless
- Trap: Alternate data streams are visible in a normal directory listing
- Trap: Overwriting once on a modern drive is insufficient
- Trap: A trimmed solid state drive still yields deleted content
cybercertprep.com · original revision sheet written from the public body of knowledge