11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
Area 11
Anti-Forensics
Covering tracks leaves tracks of its own. This area covers cleared and disabled logs, timestomping, secure deletion tools, shadow copy destruction, tampering with Defender and history cleaners, and a technique-by-technique table of the traces each one leaves behind.
Key sources
- 1102
- vssadmin
- SDelete
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Volume Shadow Copies (VSS)Volume Shadow Copies cheat sheet: store files in System Volume Information, copy-on-write blocks, deletion by ransomware, mounting and parsing.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- USN Journal ($UsnJrnl:$J)USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.
- Microsoft Defender logs and quarantineMicrosoft Defender forensics: Operational events 1116/1117/5001/5007, MPLog files, DetectionHistory, encrypted quarantine, exclusion keys and tampering traces.
- Recycle BinRecycle Bin cheat sheet: $Recycle.Bin $I and $R files, $I version 1 vs 2, XP INFO2, deletion time, original path and size, emptying and Shift+Delete traces.
- Windows Subsystem for Linux (WSL)WSL cheat sheet: Lxss registry key, WSL1 rootfs vs WSL2 ext4.vhdx, bash_history inside distros, wsl.exe execution traces, wsl$ share access and evasion.
- Mounted Disk Images (ISO, IMG, VHD, VHDX)Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.