Windows 7 Antiforensics: A Review and a Novel Approach. Issue 4 (2nd February 2017)

• Record Type: Journal Article
• Authors: Eterovic‐Soric, Brett; Choo, Kim‐Kwang Raymond; Mubarak, Sameera; Ashman, Helen
• Is Part Of: Journal of forensic sciences. Volume 62:Issue 4(2017)
• Page Start: 1054
• Page End: 1070
• Publication Date: 2017-02-02
• Subjects: forensic science -- digital forensics -- Windows 7 antiforensics -- DarkComet RAT -- Trojan Horse Defence; Medical jurisprudence -- Periodicals; Forensic sciences -- Periodicals; Forensic Medicine -- Periodicals; Gerechtelijke geneeskunde; Gerechtelijke chemie; Gerechtelijke psychiatrie; 363.2505
• DOI: 10.1111/1556-4029.13393
• Languages: English
• ISSNs: 0022-1198

Abstract

Abstract: In this paper, we review literature on antiforensics published between 2010 and 2016 and reveal the surprising lack of up‐to‐date research on this topic. This research aims to contribute to this knowledge gap by investigating different antiforensic techniques for devices running Windows 7, one of the most popular operating systems. An approach which allows for removal or obfuscation of most forensic evidence is then presented. Using the Trojan software DarkComet RAT as a case study, we demonstrate the utility of our approach and that a Trojan Horse infection may be a legitimate possibility, even if there is no evidence of an infection on a seized computer's hard drive. Up‐to‐date information regarding how forensic artifacts can be compromised will allow relevant stakeholders to make informed decisions when deciding the outcome of legal cases involving digital evidence.