Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem Eric Ly

Outline Anti-Forensics? Types of Anti-Forensics How to limit them

What is Anti-Forensics? Currently no unified definition One possible definition: the attempt to “...limit the identification, collection, collation and validation of electronic data…” so that the crime investigation is hindered (Peron and Legary, 2005) Another: ”Attempting to limit the quantity and quality of forensic evidence…”(Grugq, 2005)

What is Anti-Forensics? cont. Combining the two: Any attempts to compromise the availability or usefulness of evidence to the forensics process. Compromise evidence availability Attempts to prevent evidence from existing Hiding existing evidence Manipulating evidence Compromise usefulness Destroying its integrity

Types of Anti-Forensics Destroying evidence Hiding evidence Eliminating evidence sources Counterfeiting evidence

Destroying Evidence Dismantling evidence or otherwise making it unusable to the investigative process. Example: Wiping fingerprints off a weapon or pouring bleach in blood to destroy DNA

Hiding Evidence Act of removing evidence from view so that it is less likely to be incorporated into the forensic process Example: Throwing a knife into the river. Renaming files to throw off investigators

Eliminating Evidence Sources Neutralizing evidentiary sources No need to destroy evidence since it is never created Example: Wearing gloves to commit a crime

Counterfeiting Evidence Act of creating a fake version of the evidence which is designed to appear to be something else Example: A murder that is engineered to look like a suicide or a legitimate accident

Limiting the Effectiveness of Anti-Forensics For anti-forensics to work, they rely on inherent problems with forensics. Makes use of attacks on investigators Take advantage of dependency on specific tools or processes If the problems are targeted one by one, then effects of anti-forensics can be limited Human element Tool dependence Physical/logical limitations

The Human Element Most difficult problem to solve The alertness of the investigator, educational level, real world experience and willingness to think in new directions could all affect the detection of anti- forensics

Dependence of Tools The problem with relying on tools is that the tools are not immune to attack. An approach to reduce this is to use a variety of tools Another is to have the tools be more accurate and efficient as applied to anti- forensics

Physical/Logical Limitations Ex: Hardware connectors and protocols as well as media storage formats - physical Ex: Storage space limitations and time and money factors - logical To reduce some of the limitations, they could abide by the principle of the latest and greatest and the oldest and grayest. Investigators should be familiar with new and old technology Use multiple ways to present information Statistical analysis Process info quicker Massive indexing Better wade through the information

Conclusion Need to agree on a definition and ways of evaluating anti-forensic methods before we can determine how to respond.

Reference Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem http://dfrws.org/2006/proceedings/6-Harris.pdf