# Systematic Review: Anti-Forensic Computer Techniques
## 1 Introduction  
In computer security, computer forensics is a set of procedures and techniques for identifying, collecting, and documenting evidence from a computer system to make this evidence acceptable during a legal proceeding. Due to the constant growth of the importance of computer security in everyday life, both in the public and the professional sector, computer forensics continues to grow and become more specialized with each passing year. Like every existing discipline within computer science, the forensic field has its antagonists. These are known as anti-forensic techniques. These methods, in their broadest definition, have as their main objective the hindering or impeding of the investigation and collection of the data contained in a computer system [1]. In 2009, an article by [PERSON] et al. [2] entitled \"Computer anti-forensics methods and their impact on computer forensic investigation\" had already began to highlight the problems generated by these increasingly automated techniques in computer forensics. In this article, tables are drawn up showing the results before and after the application of anti-forensic tools, allowing for a quick appreciation of the differences. The problem is becoming more and more evident. On a first review of the state of the art in this subject, it may seem a relatively small and unimportant field, as shown by the results obtained in a specific thematic search example with the token \"computer forensics\" versus the search topic \"computer anti-forensics\", shown in Figure 1.  
In addition, most of the results for anti-forensic techniques are related to image processing (image and video manipulation); it is necessary to refine and deepen the searches to find articles directly related to these techniques as applied to the general field of forensic analysis. With such a vast difference between the scientific research in one field and the other, it could be assumed that the relevance of anti-forensic techniques is negligible, and that it is not worthwhile to delve into this field. However, when reviewing some of the most outstanding articles on this subject, we can see that the lack of knowledge of anti-forensics throws away the application of most of the existing forensic techniques and advances. How is this possible and where does the big difference in the number of scientific investigations between the two fields come from? To answer this question, we must first analyze the following two articles:  
* [PERSON] et al. [3] elaborate a taxonomy of forensic acquisition methods, which is a comprehensive survey of state-of-the-art memory acquisition techniques, independent of the operating system used and the hardware architecture. * [PERSON] et al. [4] present a study with three novel methods that prevent user space memory from appearing in analysis tools and also make it inaccessible from the perspective of security analysts. As can be seen, without knowing and avoiding the anti-forensic techniques described in the second article, the first study loses much of its value, despite its novelty. Therefore, although anti-forensic techniques represent a small percentage of computer forensics, their importance is very high. The difference in the number of publications is also directly related to the number of years that forensic analysis techniques have been available in the international context, compared to the relatively few years that anti-forensic techniques have been studied. The systematic review performed in this article followed the guidelines set out in the work of [PERSON] et al. [5; 6; 7], resulting in the following contributions:  
* Review of the existing scientific literature on anti-forensic techniques. * Grouping of the analyzed works according to the subject orientation within the field of anti-forensic techniques. * Within each topic, grouping of the analyzed works according to the technique they include. * Analysis of the state of the art of the last 6 years (2016-2022).