300-215 Question 20
Select 3During a forensic investigation, you suspect that an attacker has employed anti-forensic tactics to hinder your efforts. You notice that critical logs from a compromised system are missing, timestamps on files seem altered, and some files appear to be corrupted or encrypted. Which of the following anti-forensic techniques would most likely explain these observations?
- A
Log wiping
- B
Timestomping
- C
Data exfiltration
- D
File obfuscation
- E
Disk mirroring
Show answer and explanation
Correct answers: A, B, D
Explanation
The attacker seems to be employing multiple anti-forensic tactics to hinder the investigation. Log wiping explains the missing logs, timestomping explains the altered timestamps, and file obfuscation explains the corrupted or encrypted files. Understanding these techniques is critical for identifying and countering anti-forensic efforts during incident response.
- A. Correct.
Log wiping is a common anti-forensic tactic used by attackers to erase evidence of their activities from system logs, which could explain the missing logs.
- B. Correct.
Timestomping involves altering the timestamps of files to mislead investigators, aligning with the observed tampered timestamps.
- C. Incorrect.
Data exfiltration involves stealing data but does not directly contribute to missing logs, altered timestamps, or corrupted files. It is not an anti-forensic technique aimed at hindering investigations.
- D. Correct.
File obfuscation, such as encryption or deliberate corruption, can make forensic analysis more difficult and aligns with the observation of corrupted or encrypted files.
- E. Incorrect.
Disk mirroring is a legitimate data redundancy technique and is not relevant to anti-forensic activities.