NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Anti-Forensics Detection
Master anti-forensics detection. Learn to identify and overcome attacker techniques like timestomping, log wiping, and data hiding in DFIR.
4Guided Lab: Identifying Anti-Forensic Activity on a Disk Image
Frequently Asked Questions
What is anti-forensics?
Anti-forensics is any attempt to hinder investigation by destroying, hiding or altering evidence. Typical methods include timestomping, clearing logs, hiding data in alternate data streams and secure deletion.
How can you detect timestomping?
Compare timestamps across sources such as the $STANDARD_INFORMATION and $FILE_NAME attributes in the MFT, plus logs and the USN journal. Mismatches or impossible dates suggest tampering.
Can deleted logs be recovered or noticed?
Often yes. Gaps in event sequence numbers, log-clear events and residual copies reveal wiping. This advanced Codelivly room is free and teaches how to spot and work around these tactics.