Anti-forensics

Anti-forensics groups the techniques an attacker or a user employs to destroy, hide or falsify evidence and slow down an investigation. On Windows the most common are clearing event logs, altering file timestamps (timestomping), deleting volume shadow copies with vssadmin or WMI, deleting the USN journal with fsutil usn deletejournal, securely wiping files or free space, clearing browser history, and disabling logging or ETW providers.

The key insight is that anti-forensics rarely leaves a clean slate. Clearing the Security log records event 1102 and clearing the System log records event 104 in the Windows event logs. Running a wiping or clearing tool can itself leave Prefetch, Amcache or other execution traces. Deleted journals and logs may still be recoverable from shadow copies, unallocated space or other NTFS metadata files, and timestomped files often show inconsistencies between their $STANDARD_INFORMATION and $FILE_NAME attributes.

Treat gaps as data. A log that starts minutes before the incident response began, a USN journal with an unexpectedly recent first record, or a machine with no shadow copies when the policy says there should be some are all findings worth documenting. They do not prove malicious intent on their own — administrators and cleanup software do similar things — but they narrow the timeline and tell you where the attacker did not want you to look.