# Systematic Review: Anti-Forensic Computer Techniques
## 4 Results
### Weaknesses and Anti-Forensic Use Cases
#### 4.1.9 Weaknesses and Anti-Forensic Use Cases in File Systems  
The subject of file systems is an issue that is dealt with quite frequently in the studies analyzed. This section brings together those that deal specifically with file systems anti-forensics. [PERSON] et al. [17], in their study, collect techniques and anti-forensic tools against file systems. Other authors, such as [PERSON] et al. [179], exploit file system journaling to detect file deletion. File deletion detection is achieved by analyzing the ExT file system journal. [PERSON] et al. [180] present a strategy by which to implement anti-forensics techniques on \"ZFS\" file systems (developed by Oracle), which brings benefits and functionality based on easy administration and robust design. The works of [PERSON] et al. [181] and [PERSON] [182] deal with specific types of file systems, i.e., ext4 in the first study and NTFS in the second study. [PERSON] et al. [183] also elaborate a new anti-forensic method for hiding data in the timestamp of a file in the Windows NTFS filesystem. The proposed method utilizes the 16 least-significant bits of the 64 bits in the timestamps. [PERSON] et al. [184] propose a forensic approach based on temporal cross-referencing for NTFS, analyzing both the discrepancies and the similarities between various pieces of temporal evidence associated with file metadata and the registry to address the problems caused by anti-forensic techniques based on the manipulation of temporal references. [PERSON] et al. [185] present a new use of four existing windows artifacts (the USNjrnl, link files, prefetch files, and Windows event logs), which can provide valuable information during investigations and can be used to prove timestamp forgery. Authors such as [PERSON] et al. [186] evaluate various techniques for hiding data in the ext4 filesystem. [PERSON] et al. [187] describe the identification of timestamp patterns of various file operations on independent NTFS and ext4 file systems, as well as file interactions between file systems to detect timestamp manipulations. [PERSON] et al. [188] analyze the forensic value of the Linux B-tree file system (Btrfs) and its robustness against anti-forensic activities. [PERSON] [189] presents a tool that allows for the hiding of messages within the NTFS file system, taking advantage of the free space in the directory indexes. Further articles explore anti-forensic techniques used to hide evidence in file systems [179; 180; 17]. Some anti-forensic techniques include the secure deletion of files, the manipulation of timestamps, and the hiding data in different parts of the file system [186; 183; 187; 179; 188; 189]. Forensic researchers are also developing methods by which to detect and counteract anti-forensic techniques, such as the analysis of inconsistencies in timestamps and the use of multiple digital artefacts [184; 185; 187]. As novel contributions, a method for detecting secure file deletion on ext4 systems is proposed [179]. The anti-forensic capabilities of the Btrfs file system are analyzed [188]. A tool for hiding messages in NTFS system directories is developed [189]. And several articles propose new techniques for hiding data using timestamps [181; 183; 186]. 4.1.10. Weaknesses and Anti-Forensic Use Cases in Forensic Tools  
This section could be considered mixed as it brings together studies with different purposes: some deal with anti-forensic techniques on specific forensic tools; and others explain techniques that nullify the legal validity of evidence collected with forensic tools. The common point among all the articles in this group is that they all deal with forensic tools, but their purposes are very different. [PERSON] et al. [190] use \"TD3\", a popular disk duplicator and hardware write blocker with network capabilities, and design an attack that corrupts the integrity of the target drive (a drive with the duplicated evidence) without the user's knowledge to reveal the vulnerability of digital forensic tools to anti-forensic attacks.