300-215 Question 17
Select 3During a forensic investigation, you suspect that a malicious actor has used antiforensic tactics to hinder the analysis process. Which of the following actions are considered antiforensic techniques that might have been employed to evade detection and complicate the investigation?
- A
Encrypting critical files to obstruct forensic analysis.
- B
Deleting system logs to remove evidence of activity.
- C
Using a secure VPN to encrypt network traffic during an attack.
- D
Altering file timestamps to mislead investigators.
- E
Deploying endpoint detection and response (EDR) tools to monitor the victim's system.
Show answer and explanation
Correct answers: A, B, D
Explanation
Antiforensic tactics are deliberate actions aimed at obstructing or complicating forensic investigations. These include encrypting files to restrict access, deleting logs to erase evidence, and altering timestamps to mislead investigators. While using a VPN is a stealth tactic and deploying EDR is a protective measure, these do not qualify as antiforensic techniques as they do not directly interfere with the forensic process.
- A. Correct.
Encrypting critical files is a common antiforensic tactic used to make data inaccessible to investigators without the decryption key.
- B. Correct.
Deleting system logs is an antiforensic method aimed at erasing traces of malicious activity, making it difficult to reconstruct the attack timeline.
- C. Incorrect.
Using a VPN during an attack is a stealth tactic to mask an attacker's origin, but it does not qualify as an antiforensic technique since it does not directly interfere with forensic analysis.
- D. Correct.
Altering file timestamps is an antiforensic technique designed to manipulate evidence and mislead investigators regarding the timing of events.
- E. Incorrect.
Deploying EDR tools on the victim's system is not an antiforensic action; these tools are typically used for legitimate monitoring and protection purposes.