# Systematic Review: Anti-Forensic Computer Techniques
## 3 Fundamentals of Anti-Forensic Science
In explaining each of these fields, they make these anti-forensic techniques known and suggest measures by which to avoid or mitigate them as much as possible. The objective of this study has two components:  
* To serve as a knowledge update for anti-forensic experts. * To show where to look if you suspect the use of any of these techniques. The limitations of the work are evident based on the objectives it pursues. It is an update of knowledge, not a new classification of anti-forensic techniques; therefore, the detail in the explanation is quite limited compared to other more explicit explanations, such as the one elaborated by [PERSON] et al. [10]. [PERSON] et al. [16] present several suggestions for how to address the following weaknesses present in computer forensics:  
* The human element in the process. * Reliance on forensic tools. Physical and logical limitations. The paper aims to investigate some anti-forensic methods and tries to summarize some of the countermeasures that can be applied. The main limitations of this study are that the countermeasures proposed do not resemble a methodology by which to extract guidelines to follow or a practical guide to be applied in use cases. The authors propose a set of suggestions applied to each of the weaknesses exposed by [PERSON] [12] in his article. The work could be considered an exposition of ideas that should be considered when it comes to standardizing and further formalizing the guidelines of the computer forensic discipline. [PERSON] et al. [17] focus their attention on the study of anti-forensic techniques applied to file systems. To develop it, they use the traditional classification of anti-forensic techniques--i.e., artefacts deletion, data hiding, evidence obfuscation, and attack on forensic tools)--but focus on their application to file systems. For each of the sections into which the article is divided, the article defines what the anti-forensic technique consists of and some of the tools with which they are performed. The sections are as follows:  
* Artefact wiping. * Data hiding. * Reserved locations. * Slack space. * Extended attributes, forks, and alternate data streams. * Cryptographic file systems. * Steganographic file systems. * Mounting. * Trail obfuscation. * Forging timestamp. * Modifying magic numbers. * Using live distros. * Attacking forensic tools. * Dropping a compression bomb. * Opening a sparse file. * HPA/DCO, file encryption, and steganography. The objective of the work being the exposition of anti-forensic techniques, focusing on the file system, it can be said that it exposes, briefly and concisely, each one of the above sections, making the forensic investigator aware of the most problematic techniques that can be found during the analysis of a computer system. This study is a good complement to the rest of the works presented, and the limitation of this research is the same as most of them, which is that it does not present a methodology that allows the forensic investigator to detect or avoid the use of these anti-forensic techniques. [PERSON] et al. [18] present a forensic analysis method by which to detect a particular anti-forensic technique, known as timestamp forgery/time stomping, for the specific case of the NTFS file system. To carry out this work, they focus on the $MFT and $LOGFILE structures. The main attributes that the paper discusses are the $LogfileSequenceNumber (LSN), $Standarddy, and $Filename. The authors establish two timestamp forgery processes generated by the malware:  
* Change the operating system timestamp. * Manipulate the MACE values of NTFS system files. Having explained all the above, the authors of the article go on to generate mathematical formulae to establish 14 normal file processing patterns and 7 comparison rules for detecting timestamp forgery.