Each theoretical or background section concludes with a series of review questions, which are prepared to test students’ understanding of the materials, while the practice exercises are intended to afford students the opportunity to apply the concepts introduced in the section on background knowledge. Beginning with the basic concepts of computer forensics, each of the book’s 21 chapters focuses on a particular forensic topic composed of two parts: background knowledge and hands-on experience through practice exercises. This textbook provides an introduction to digital forensics, a rapidly evolving field for solving crimes. Our findings indicate a need for future endeavors in creating and maintaining exhaustive anti-forensic hash data sets. As part of our analysis, the collected hash set was ran against the National Institute of Standards and Technology's 2016 National Software Reference Library, and only 423 matches were found out of the 2780 hashes. We also publicly share our data sets, which includes categorical data on 308 collected anti-forensic tools, as well as 2780 unique hash values related to the installation files of 191 publicly available anti-forensic tools. This category was labeled as Possible indications of anti-forensic activity, as certain software, scenarios, and digital artifacts could indicate anti-forensic activity on a system. Our work also takes into consideration anti-forensic activity which utilizes tools that were not originally designed for anti-forensic purposes, but can still be used with malicious intent. We then devise an extended anti-forensic taxonomy to the one proposed by Rogers (2006) in order to create a more comprehensive taxonomy and facilitate linguistic standardization. In this work we first collect and categorize 308 anti-digital forensic tools to survey the field. Thus, new research initiatives and strategies must be formulated to address this growing problem. Moreover, we develop a taxonomy of ambiguous file system partitions and argue that the existence of essential data at fixed positions still is a way to distinguish host from guest and so to heuristically reduce the ambiguity, without removing it completely.Īnti-forensic tools, techniques and methods are becoming a formidable obstacle for the digital forensic community. We test common forensic tools on these examples and exhibit some deficiencies. In a third example we even integrate two guest file systems (HFS+ and FAT32) into a single Btrfs file system partition. We show that it is possible to create ambiguous file system partitions by integrating a guest file system into the structures of a host file system in two cases: We integrate a fully functional FAT32 into Ext3 and HFS+. Since typical file systems that occur in forensic analysis are usually unambiguous, ambiguous file system partitions may be useful corner cases in forensic tools and processes. The problem is different from steganographic data hiding since there is no real distinction between content and cover data, and no translation process may be applied to the content data. We investigate the problem of creating ambiguous file system partitions, i.e., the possibility to have two fully functional file systems within a single file system partition. Finally, the newly found techniques are evaluated, e.g., on the basis of their detectability, stability and capacity. After a short theoretical introduction to the framework, we present, as a practical part of this work, specific data hiding techniques for APFS which are implemented in a separate module for fishy. A recently published modular anti-forensics framework called fishy allows the implementation of modules containing a file system interface and corresponding data hiding techniques. This paper aims to introduce APFS and some of its noncritical areas which can be exploited to hide data. However, anti-forensic techniques specific to APFS have not yet been explored. There are only a few published forensic analyses of APFS so far and some forensic tools like the Sleuthkit have at least partially adapted APFS functionality. For the Apple File System (APFS), the new standard file system for all Apple devices, only part of the previous work is transferable. There are quite a few theoretical approaches and also some practical tools that help us to hide data in the existing file systems in different ways. Many of the currently used file systems such as FAT, NTFS or ext4 have been thoroughly analysed. Data hiding is an important part of anti-forensic research since the continuous development of operating systems, file systems and other software may close some previously known vulnerabilities but will often inadvertently create new ones.

Ibored file recovery