300-215 Question 18
Select 4During a forensic investigation of a compromised server, your team discovers that the attacker has used several antiforensic techniques to hinder the analysis. Which of the following actions should you recognize as antiforensic tactics, techniques, or procedures?
- A
Modifying file timestamps to mislead investigators
- B
Using a secure delete tool to overwrite sensitive files
- C
Deploying a host-based intrusion detection system (HIDS) to monitor activity
- D
Encrypting data before exfiltration to prevent detection
- E
Clearing system logs to remove traces of activity
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Antiforensic tactics, techniques, and procedures are methods used by attackers to hinder forensic investigations and avoid detection. These include modifying timestamps (timestomping), securely deleting files to prevent recovery, encrypting stolen data to obfuscate its contents, and clearing logs to erase evidence of activities. Defensive measures, such as deploying HIDS, do not fall under antiforensic techniques as they are proactive security strategies rather than obfuscation or destruction methods.
- A. Correct.
Modifying file timestamps, also known as timestomping, is a common antiforensic technique used to mislead investigators by altering the timeline of events.
- B. Correct.
Using a secure delete tool ensures that files are overwritten and cannot be recovered, which is a core antiforensic method to prevent forensic recovery.
- C. Incorrect.
Deploying a host-based intrusion detection system (HIDS) is not an antiforensic technique; rather, it is a defensive security measure to monitor and alert on suspicious activity.
- D. Correct.
Encrypting data before exfiltration is a tactic used by attackers to obfuscate stolen data, making it harder for investigators to analyze or detect during transit.
- E. Correct.
Clearing system logs removes evidence of attacker activity, which is a direct antiforensic procedure aimed at avoiding detection.