Premium
Windows 7 Antiforensics: A Review and a Novel Approach
Author(s) -
EterovicSoric Brett,
Choo KimKwang Raymond,
Mubarak Sameera,
Ashman Helen
Publication year - 2017
Publication title -
journal of forensic sciences
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.715
H-Index - 96
eISSN - 1556-4029
pISSN - 0022-1198
DOI - 10.1111/1556-4029.13393
Subject(s) - trojan horse , obfuscation , trojan , computer security , computer science , digital evidence , digital forensics , software , outcome (game theory) , internet privacy , data science , operating system , mathematics , mathematical economics
In this paper, we review literature on antiforensics published between 2010 and 2016 and reveal the surprising lack of up‐to‐date research on this topic. This research aims to contribute to this knowledge gap by investigating different antiforensic techniques for devices running Windows 7, one of the most popular operating systems. An approach which allows for removal or obfuscation of most forensic evidence is then presented. Using the Trojan software DarkComet RAT as a case study, we demonstrate the utility of our approach and that a Trojan Horse infection may be a legitimate possibility, even if there is no evidence of an infection on a seized computer's hard drive. Up‐to‐date information regarding how forensic artifacts can be compromised will allow relevant stakeholders to make informed decisions when deciding the outcome of legal cases involving digital evidence.