# Systematic Review: Anti-Forensic Computer Techniques
## 3 Fundamentals of Anti-Forensic Science
Generally, these accounts have been used in illicit activities, and it is desirable to detect whether they have existed previously, as well as to obtain information from them. The authors begin by outlining the artefacts they will use for analysis, along with a short description of the artefacts:  
1. Windows events. 2. Windows registry. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Erasing Method** & **Security Level** & \begin{tabular}{c} **Overwriting** \\ **Rounds** \\ \end{tabular} & **Pattern Used** & **Comments** \\ \hline Single overwrite & Low & 1 & Writes a zero & Can prevent software recovery tools from recovering data but cannot stop hardware-based recovery tools from recovering deleted data. \\ \hline NCSC-TG-025 & & & All zeros, all ones, and finally writes a random character and verifies the write & Software recovery tools and most hardware-based recovery tools cannot recover data deleted this way. This technique is like HMG IS5 (UK) and DoD 5220.22-M (USA). \\ Gutmann & High & 35 & Writes a random character & This is an old technique invented in 1996; the encoding for HDD has changed since then. This method is not recommended for modern HDDs. \\ \hline Schneier & High & 7 & All ones, all zeros; random characters are written five times & Prevents software recovery tools and almost all hardware-based techniques from recovering data. \\ \hline ISM 6.2.92 & Medium & 1 & \
\begin{tabular}{c} Random pattern (only for disks bigger than 15 GB) \\ \end{tabular} &
\begin{tabular}{c} Invented in 2014 by the Australian Department of Defense: Intelligence and Security. Prevents software recovery tools and most hardware-based techniques from recovering data. \\ \end{tabular} \\ \hline \hline \end{tabular}  
To conclude, sections on direct attacks on forensic software represent a very small fraction of the anti-forensic techniques dedicated to hiding the commission of illegal activities; therefore, it would be necessary to complement it with other articles to obtain a larger knowledge base.  
\end{table} 
Table 3: Data destruction techniques. Figure 6: Threat model of B. [PERSON] et al. (2011). * RAM. * Memory paging system. * Windows prefetch system. * Windows Superfetch system. * Windows image cache. * Windows jump lists. * Navigation files. The main utility of this development is that it serves as a starting point for research on user account deletion. It identifies the most important artefacts in this type of analysis and makes a detailed use case, which allows for extrapolation to different Windows operating systems. The study itself mentions as its limitations the obtaining of information from the RAM if the equipment is turned off; some registers are not activated by default in the operating systems, and the browsers incorporate options easily modified by the user, which allow for almost all the stored registers to be eliminated. This work, which is complemented by others detailing data deletion tools ([PERSON] et al. [10]), provides a better idea of how to recover evidence and determine if deletion tools have been used. [PERSON] et al. [15] have elaborated a study in which they highlight the great importance that the subject of \"anti-forensics\" has acquired, to the point of becoming an emerging field of study in need of major expansion. It exposes the general anti-forensic categories, bringing together what has been published by several authors in the following classification system:  
* Data hiding, obfuscation, and encryption. * Deletion or destruction of data. * Data tampering. * Prevention of analysis. * Obstruction of trace collection. * Subversion tools. The study mentions the need to present more-modern anti-forensic techniques, and this is why it focuses on the following classifications:  
* Data pooling. * Non-standard RAID disks. * File signature manipulation. * Restricted file names. * MACE time manipulation
* Loop references. * Hash collisions. * Fake hard disks.