The Impact of Anti-forensic Techniques on Data-Driven Digital Forensics: Anomaly Detection Case Study
摘要
Digital forensics is vital in responding to cybersecurity threats and incidents by enabling investigators to identify, collect, and analyze digital evidence. As cyberattacks become increasingly sophisticated, adversaries leverage anti-forensic techniques to evade detection and hinder forensic investigations. These techniques aim to remove, obfuscate, or manipulate digital traces, thereby reducing the effectiveness of forensic analysis. Despite growing interest in anti-forensics, limited attention has been given to systematically evaluating their real-world impact. In this paper, we investigate the effects of selected anti-forensic techniques, such as file deletion, log deletion, data hiding in alternate data streams (ADS), encryption, fake evidence creation, and timestamp manipulation, on two critical aspects: the integrity and availability of digital traces, and the accuracy of algorithmic anomaly detection in data-driven forensic analysis. Our study is guided by two primary research questions: (1) How can the impact of anti-forensic techniques on specific digital artifacts and anomaly detection accuracy be quantified? (2) What is the measurable effect of selected anti-forensic techniques on the quality and reliability of forensic investigations? To address these questions, we propose a methodology based on impact levels and an impact matrix supported by quantitative evaluation using precision, recall, and F1 score. Experiments were conducted using a Windows operating system with an NTFS filesystem.