Describing and Categorizing Disk-Avoiding Anti-Forensics Tools

Abstract

ABSTRACT Disk-avoiding anti-forensics tools are now being used to prevent current forensics tools from detecting their activities. These new tools must be described and categorized in order for forensics investigators to be aware of and therefore able to detect the tools and collect the information they produce. This article builds upon existing categories used to classify anti-forensics methods, such as evidence source elimination and data contraception, and provides useful information for understanding the current and anticipated trends in anti-forensics.