Detecting anti-forensics
You catch timestomped files, deleted or tampered logs, secure wiping and hidden data, and prove what happened even on a system that appears to have no traces.
Level 501 · 12 lessons · 12 practice labs
Lessons
Tampering with time and logs
- Timestomping: the $SI versus $FN gap
- Catching the change itself in $UsnJrnl
- Tampered logs: record numbers, gaps and a second source
- Short task: find three timestomped files and estimate their real times
Wiping and hiding
- The traces secure-wipe tools leave behind
- Encrypted containers and hidden volumes: detecting they exist
- Hiding places: HPA, DCO, slack and unallocated space
- The attacker’s own clean-up: clearing history, removing tools
- Short task: prove a deleted tool existed using four different traces
Reporting and defence
- Absence of evidence is not evidence of absence: wording in reports
- Logging that resists tampering: remote logs and immutable storage
- Capstone: rebuild what the attacker did on a “cleaned” server
Practice labs
- Compare the $SI and $FN times: Write five files' times from the two attributes side by side and mark the mismatch.
- Find three files with tampered times: Find three files with tampered times in a prepared image and estimate the true time.
- Catch the change itself in $UsnJrnl: Find the journal record of the timestamp change and prove the moment it was made.
- Find the gap in the record numbers: Scan the record numbers in an event log and report the missing range.
- Check a tampered log against a second source: Find the events missing from the local log in the remote log copy.
- Design tamper-resistant logging: Set up remote log forwarding and immutable storage on the lab server and show a local deletion does not destroy the evidence.
- Recognise the trace of a wiping tool: Find the traces showing a wiping tool ran from file name and content patterns.
- Detect the presence of an encrypted container: Find the large high-entropy headerless file and the traces of the software that mounted it.
- Prove a deleted tool existed through four traces: Prove a removed tool existed with execution record, journal, shortcut and unallocated space traces.
- Traces left in a shell with wiped history: Gather the traces remaining in place of wiped command history from memory, journal and file times.
- Describe absence correctly in the report: Rewrite three findings in language that does not confuse absence of evidence with evidence of absence.
- Reconstruct events on a cleaned server: In Karaçam Mobilya's prepared image, reconstruct in time order what was done on a server whose traces were wiped from the remaining sources.
About this course
You catch timestomped files, deleted or tampered logs, secure wiping and hidden data, and prove what happened even on a system that appears to have no traces.
What you will learn
- Tampering with time and logs
- Wiping and hiding
- Reporting and defence
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.