300-215 Question 175
Select 3During an investigation of a cybersecurity incident, a forensic analyst observes that certain log files from a critical server are missing. Upon further inspection, it is discovered that the attacker used a tool to overwrite the logs with random data before deleting them. Which antiforensic techniques are most likely being used in this scenario?
- A
Data destruction
- B
Obfuscation
- C
Geo location
- D
Hindering forensics
- E
Evading detection
Show answer and explanation
Correct answers: A, D, E
Explanation
In this scenario, the attacker employed multiple antiforensic techniques. By overwriting log files with random data, they used data destruction to ensure the logs could not be recovered. This also qualifies as hindering forensics because it actively obstructs the investigative process. Additionally, by removing evidence of their activities, the attacker aimed to evade detection by the forensic team.
- A. Correct.
Data destruction refers to the intentional removal or overwriting of data to prevent recovery, which matches the behavior observed in this scenario where logs were overwritten and deleted.
- B. Incorrect.
Obfuscation refers to making data difficult to understand or interpret but does not directly involve overwriting or deleting log files, so this is not applicable here.
- C. Incorrect.
Geo location involves identifying the physical location of a user or device and does not relate to the overwriting or deletion of log files.
- D. Correct.
Hindering forensics involves implementing strategies to make forensic analysis more difficult, such as overwriting logs to prevent investigators from obtaining useful information.
- E. Correct.
Evading detection involves taking measures to avoid being identified or tracked, such as destroying logs to prevent evidence of the attack from being found.