<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-anti-forensics-detection
description: >-
  Detection and analysis of anti-forensic techniques including timestamp
  manipulation (timestomping), log clearing, secure deletion detection,
  alternate data streams, rootkit artifacts, evidence destruction tools,
  and filesystem manipulation used to obstruct forensic investigations.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - anti-forensics
  - timestomping
  - log-clearing
  - secure-deletion
  - alternate-data-streams
  - rootkit-detection
  - evidence-destruction
  - data-hiding
  - slack-space
  - file-wiping
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1070", "T1070.001", "T1070.003", "T1070.004", "T1070.006"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "SANS FOR508"]
---

# Performing Anti-Forensics Detection

## Overview

Anti-forensics encompasses techniques used to obstruct forensic
investigation: timestomping, log/artifact clearing, secure deletion,
data hiding in alternate data streams or slack space, and rootkit
deployment. Detecting these techniques is critical for establishing
evidence integrity and identifying deliberate concealment.

## Prerequisites

- Forensic image (never analyze live suspect system)
- `Sleuth Kit` (mactime, fls, icat), `plaso`/`log2timeline`
- `rkhunter`, `chkrootkit` for rootkit detection
- `NTFS-3G` for ADS analysis, `foremost`/`scalpel` for carving
- Python 3.10+ with `python-registry`

```bash
sudo apt install sleuthkit rkhunter chkrootkit foremost scalpel ntfs-3g
pip install plaso dfvfs python-registry
```

## Key Concepts

### Anti-Forensic Technique Categories

| Category | Technique | Detection Method |
|----------|-----------|-----------------|
| Timestamp Manipulation | Timestomping (SetMACE) | $SIA vs $FN comparison in MFT |
| Log Destruction | Event log clearing | Event ID 1102/104, gap analysis |
| Secure Deletion | SDelete, shred, wipe | MFT resident data remnants |
| Data Hiding | ADS, slack space, HPA/DCO | ADS enumeration, slack analysis |
| Trail Obfuscation | Prefetch/shellbag deletion | Missing expected artifacts |
| Rootkits | Kernel-level hiding | Cross-view detection, integrity check |

### Timestomping Detection Logic

```
$STANDARD_INFORMATION (SIA) — easily modified by tools like timestomp
$FILE_NAME (FN) — only modified by the OS kernel

Detection: If SIA timestamps differ significantly from FN timestamps,
timestomping is indicated. Also check:
- SIA modified time < SIA created time (impossible normally)
- Timestamps rounded to suspicious values (all zeros in subseconds)
- $FN created time much later than $SIA created time
```

## Workflow

### Step 1: Detect Timestomping via MFT Analysis

```bash
# Extract MFT from NTFS image
icat -o $OFFSET evidence.dd 0 > MFT

# Parse MFT with analyzeMFT
analyzeMFT.py -f MFT -o mft_parsed.csv

# Compare $SIA vs $FILE_NAME timestamps
python3 -c "
import csv
with open('mft_parsed.csv') as f:
    reader = csv.DictReader(f)
    for row in reader:
        sia_created = row.get('SI Created', '')
        fn_created = row.get('FN Created', '')
        if sia_created and fn_created and sia_created != fn_created:
            print(f\"TIMESTOMP: {row.get('Filename', '')}\"
                  f\" SIA={sia_created} FN={fn_created}\")
"

# Plaso timeline — look for temporal anomalies
log2timeline.py --storage-file timeline.plaso evidence.dd
psort.py -w timeline.csv timeline.plaso
# Search for files with suspicious timestamp patterns
grep -E "\.exe|\.dll|\.ps1" timeline.csv | sort -t, -k1 | head -50
```

### Step 2: Detect Log Clearing

```bash
# Windows Event Log clearing detection
# Event ID 1102 — Security log cleared
# Event ID 104 — System log cleared
python3 -c "
import Evtx.Evtx as evtx
with evtx.Evtx('Security.evtx') as log:
    for record in log.records():
        xml = record.xml()
        if 'EventID>1102<' in xml or 'EventID>104<' in xml:
            print(f'LOG CLEARED at record {record.record_num()}')
            print(xml[:500])
"

# Check for gaps in Event ID sequences
python3 -c "
import Evtx.Evtx as evtx
with evtx.Evtx('Security.evtx') as log:
    ids = [r.record_num() for r in log.records()]
    for i in range(1, len(ids)):
        gap = ids[i] - ids[i-1]
        if gap > 10:
            print(f'GAP: {ids[i-1]} -> {ids[i]} (missing {gap-1} records)')
"

# Linux — check for truncated/missing logs
ls -la /var/log/auth.log* /var/log/syslog* /var/log/wtmp
# Empty files with recent modification = suspicious
find /var/log/ -empty -newer /var/log/syslog -ls
```

### Step 3: Detect Secure Deletion

```bash
# Search for deletion tool artifacts
find /mnt/evidence/ -iname "*sdelete*" -o -iname "*eraser*" \
  -o -iname "*bleachbit*" -o -iname "*ccleaner*" 2>/dev/null

# Check Prefetch for deletion tool execution
ls /mnt/evidence/Windows/Prefetch/ | grep -iE "sdelete|eraser|bleach|ccleaner"

# Carve deleted files from unallocated space
foremost -t all -i evidence.dd -o ./carved/
scalpel evidence.dd -o ./scalpel_output/

# Check for overwrite patterns in free space
dd if=evidence.dd bs=512 skip=$FREE_OFFSET count=100 | xxd | head -20
# Patterns like 0x00, 0xFF, or 0xAA/0x55 indicate secure deletion
```

### Step 4: Alternate Data Streams (ADS)

```bash
# List ADS on NTFS image
fls -r -o $OFFSET evidence.dd | grep -i "ads\|:"

# Extract ADS content
icat -o $OFFSET evidence.dd $INODE:$ADS_NAME > ads_content.bin

# Windows — enumerate ADS (on live/mounted NTFS)
dir /r C:\Users\suspect\Desktop\
Get-Item -Path C:\file.txt -Stream * | Select-Object Stream, Length

# Search for Zone.Identifier (download origin)
find /mnt/evidence/ -name "*.txt:Zone.Identifier" 2>/dev/null
```

### Step 5: Rootkit Detection

```bash
# rkhunter scan
rkhunter --check --sk --rwo

# chkrootkit
chkrootkit -r /mnt/evidence/

# Cross-reference process list with /proc
# Hidden processes show in /proc but not in ps
ls /proc/ | grep -E "^[0-9]+$" | sort -n > proc_pids.txt
ps aux | awk '{print $2}' | sort -n > ps_pids.txt
diff proc_pids.txt ps_pids.txt

# Check for kernel module hiding
lsmod > loaded_modules.txt
cat /proc/modules > proc_modules.txt
diff loaded_modules.txt proc_modules.txt

# Verify system binary integrity
rpm -Va 2>/dev/null | grep -v "^\.\.\."  # RPM-based
debsums -c 2>/dev/null                    # Debian-based
```

## Detection

```yaml
title: Anti Forensics Detection Detection
id: 3873bcab-235c-4fbe-b420-22ce5dd78dd1
status: experimental
description: Detects suspicious activity related to performing anti forensics detection techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*anti*"
  condition: selection
level: medium
tags:
  - attack.t1070
  - attack.t1070.001
  - attack.t1070.003
  - attack.t1070.004
  - attack.t1070.006
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] MFT parsed and SIA/FN timestamp comparison completed
- [ ] Event log clearing events (1102/104) checked
- [ ] Log file gaps and anomalies documented
- [ ] Deletion tool artifacts searched in Prefetch and filesystem
- [ ] Alternate data streams enumerated
- [ ] Free space analyzed for overwrite patterns
- [ ] Rootkit detection scans completed
- [ ] All anti-forensic findings documented with confidence levels

## References

- [SANS FOR508 — Advanced Incident Response](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/)
- [MITRE ATT&CK T1070 — Indicator Removal](https://attack.mitre.org/techniques/T1070/)
- [Sleuth Kit — icat, fls, mactime](https://sleuthkit.org/)
- [analyzeMFT](https://github.com/dkovar/analyzeMFT)
- [rkhunter](http://rkhunter.sourceforge.net/)
- [foremost — File Carving](https://foremost.sourceforge.net/)
