Overview Of Anti-Forensics Tools

The first anti-forensics tool I explored was a steganography tool called OpenStego. OpenStego can hide data, extract data, generate signatures, embed watermarks, and verify a watermark. To test these anti-forensics tool, I opened an image of a beautiful beach as my cover photo. Then I threw in an image of the OpenStego icon to hide. The image of the OpenStego logo was hidden within my beach cover photo. The output file I named hidden.jpeg. So, when I open hidden.jpeg I see a beautiful beach. I also used a password of 0123 when encrypting the stenographic image. So next I hit extract data in OpenStego and selected my hidden.jpeg and created an output folder called output on my desktop. I entered in my password, 0123, and then hit extract data. Now the output folder on my desktop contained the OpenStego logo/icon image.

The use of this tool is to hide obscene images or maybe even other file types that have valuable data from investigators. For example, nudity could be hidden within another image that looks like a nice sunset or landscape. Or even a text file with coordinates to a drop off/pick up location could be hidden within an image. This makes it hard for investigators to find data and makes it hard for investigators to detect data that is hidden. Investigators can mitigate steganography by either checking the images, but more commonly observing the image file size or extension. For example, my original beach image was 39 kb, small. My steganographic image was 898 kb, still very small on a computer with terabyte(s) of data, but very large compared to the original. So naturally the anti-forensics tool that goes hand in hand with steganography and data hiding is an eraser tool. There are lots of free tools that degauss disk and erase files over and over to ensure they are gone. The tool I chose was Eraser, an open source erasing tool for hard disks. Eraser allows you to delete a file or even an entire hard drive. Eraser can also be setup to delete these files on a schedule (weekly, daily, monthly), or be ran manually, on restart, or reoccurring. I chose to run the eraser manually and programmed the eraser to erase my hidden.jpeg steganography photo. In eraser you can select many ways of overwriting the data. I chose a 35-pass run and selected my hidden.jpeg file. As soon as I ran eraser I observed my desktop in the background, after eraser completed the task the hidden.jpeg file was instantly erased. This is extremely helpful for anti-forensics as you can set eraser to delete a folder, a drive, a file, etc. And since eraser can do this on shut down, or restart, an inexperienced forensic investigator might risk losing all their data. Eraser can also ruin an investigation with a scheduled erase every Tuesday for example. To mitigate this forensic analyst, need to be aware of all free and paid erasing tools. Searching for these tools and ensuring they are not installed on the host machine is extremely important. Forensic analyst can also make a system image before shutting down the pc or moving it to ensure there is a copy in the event of an unexpected erase. In extreme cases some forensic investigators have found deleted data still active in ram, or have found duplicate data, or data that is open in another program in progress, or even fragments and traces of a deleted file. Often files that have been sent can also be found on other machines, servers, or clouds even if deleted off the local machine.

Another common anti-forensics tool is trail obfuscation. This is when an individual attempts to hide or cover up their trails. Very similar to data hiding methods like stenography. For example, let’s say I didn’t wipe that hidden.jpeg image off my machine. And let’s say I wanted to hide all my .jpeg files for whatever reason. Individuals will use trail obfuscation software to change the location of those files. I could also change all the names of .jpeg files to .pdf files or .doc files and then hide them deep in a nested location. This fools investigative software’s that would scan for images and the software would miss the images because the images don’t appear as images to the image scanning software. This would allow an individual to hide a lot of photos from software scans and would make forensic work a little more hands on.

A great program for this is something that is baked right into windows. MkDir is a great program for making file paths that can be nested to thwart forensic investigations. These locations are perfect for hiding all your data. For example, you could navigate to drive c: and then make a hidden directory and a hidden directory 2 and 3 and so on, but make them lead to a directory called hidden, which is different from the original hidden but appears to be the same, and then make the real folder actually hidden on the hard drive. Without the investigator looking for hidden files within those nested directories he or she could miss something. To visualize this path, it could look something like c:hiddenhidden2hidden3hidden and within the hidden3 folder there could also be a hidden folder, and another folder named anything that is hidden. And the investigator might be fooled into thinking the files are heavily nested and become side tracked. Also, this method could extend to hundreds of directories created on a hard disk. This could cause an investigation to take longer than expected.