Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and reactive measures. Diverse and realistic datasets that reflect anti-forensic measures are needed to validate digital forensic tools and advance digital forensics education and research. However, datasets are increasingly created in a synthetic manner due to privacy and legal constraints. The work described in this chapter contributes to improving the digital forensic process by assessing anti-forensic measures at the filesystem level and providing a means for synthesizing datasets containing anti-forensic artifacts. Specifically, it provides an in-depth analysis of anti-forensic data hiding techniques in the evolving Linux-based B-tree filesystem (Btrfs). Also, it presents a methodology for generating anti-forensic traces at the filesystem level in a post mortem storage device dataset. The methodology links the ForTrace data synthesis framework and fishy anti-forensic data hiding framework. A data synthesis tool is developed for generating anti-forensic data hiding traces for three common filesystems, NTFS, ext4 and Btrfs, and providing essential data synthesis functionality to simulate the expected behavior of the operating system. Additionally, a validation model comprising three complexity levels is presented for assessing the implemented anti-forensic data hiding techniques. Overall, the research provides a powerful approach for generating datasets that reflect anti-forensic artifacts potentially used by attackers.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Generating Usable and Assessable Datasets Containing Anti-Forensic Traces at the Filesystem Level

  • Thomas Göbel,
  • Harald Baier,
  • Jan Türr

摘要

Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and reactive measures. Diverse and realistic datasets that reflect anti-forensic measures are needed to validate digital forensic tools and advance digital forensics education and research. However, datasets are increasingly created in a synthetic manner due to privacy and legal constraints. The work described in this chapter contributes to improving the digital forensic process by assessing anti-forensic measures at the filesystem level and providing a means for synthesizing datasets containing anti-forensic artifacts. Specifically, it provides an in-depth analysis of anti-forensic data hiding techniques in the evolving Linux-based B-tree filesystem (Btrfs). Also, it presents a methodology for generating anti-forensic traces at the filesystem level in a post mortem storage device dataset. The methodology links the ForTrace data synthesis framework and fishy anti-forensic data hiding framework. A data synthesis tool is developed for generating anti-forensic data hiding traces for three common filesystems, NTFS, ext4 and Btrfs, and providing essential data synthesis functionality to simulate the expected behavior of the operating system. Additionally, a validation model comprising three complexity levels is presented for assessing the implemented anti-forensic data hiding techniques. Overall, the research provides a powerful approach for generating datasets that reflect anti-forensic artifacts potentially used by attackers.