# Anti-Forensics Detection

> Master anti-forensics detection. Learn to identify and overcome attacker techniques like timestomping, log wiping, and data hiding in DFIR.

Canonical: https://codelivly.com/rooms/anti-forensics-detection
Last updated: 2026-09-17

| | |
|---|---|
| Level | Advanced |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This advanced module dives deep into the detection and mitigation of anti-forensic techniques used by sophisticated threat actors. You will learn how to identify and overcome tactics designed to thwart digital investigations, including timestomping, log wiping, file carving evasion, encryption, and data hiding in Alternate Data Streams (ADS) or slack space. By mastering anti-forensics detection, you will be equipped to recover destroyed evidence, expose attacker deception, and build ironclad, legally defensible incident narratives even when adversaries actively attempt to cover their tracks.

## Lessons

1. What Is Anti-Forensics and Why Does It Matter (30 min)
2. Common Anti-Forensic Techniques (Wiping, Timestomping, Encryption) (30 min)
3. Detecting Evidence of Tampering (30 min)
4. Guided Lab: Identifying Anti-Forensic Activity on a Disk Image (30 min)

## Related

- [Learning path: Timeline Analysis and Artifact Correlation](https://codelivly.com/learning-paths/timeline-analysis-and-artifact-correlation)
- [All rooms](https://codelivly.com/rooms)