{"id":263,"date":"2023-08-19T03:59:01","date_gmt":"2023-08-19T03:59:01","guid":{"rendered":"https:\/\/www.anti-forensics.com\/blog\/?p=210"},"modified":"2024-03-08T00:23:47","modified_gmt":"2024-03-08T00:23:47","slug":"shkval-remote-wiping-software-for-linux-2","status":"publish","type":"post","link":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/","title":{"rendered":"shkval &#8211; Remote Wiping Software for Linux"},"content":{"rendered":"\n<h4 class=\"wp-block-heading\">What shkval Does<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">shkval is an example of a <strong>remote wiping software<\/strong> that can be used on any Linux system utilizing <code>nftables<\/code>. nft rules are implemented on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the server. We will use entries from dmsg instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">dmesg is queried, and line-by-line the received packets are verified against hardcoded values stored in &#8220;server.py&#8221;. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first value is the &#8220;command_password&#8221; which is 20 characters in length. This password is verified against the received packet data (TCP options) in dmesg.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second value is the &#8220;command_port&#8221;. This value is checked against the &#8220;source_port&#8221; from the received packet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Both of these values are used to determine if the &#8220;shred&#8221; utility should be run. If they match, the shred utility will carry out a file wiping operation for the file stored in the &#8220;server.py&#8221; script.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this example, <code>scapy<\/code> is used on the client (client.py) to construct and send a packet of data to the server. This packet is built with the specific data, mentioned prior, that is used to determine whether or not to initiate a shred operation.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>from scapy import all as scapy\n\ncommand_password = \"dlSmtkQaGTfATveHtjwb\"  # MUST BE 20 CHARACTERS\ncommand_port = 666\n\nassert len(command_password) == 20\n\nscapy.sr(scapy.IP(dst=\"10.0.2.23\") \/ scapy.TCP(sport=command_port, dport=666, seq=1, ack=0, flags=\"S\",\n                                               urgptr=0, options=&#91;(19, command_password)]))<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">server.py Hardcoded Parameters<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>file_to_delete_full_path = \"\/tmp\/secrets.db\"\ncommand_password = \"dlSmtkQaGTfATveHtjwb\"\ncommand_port = \"666\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The variables store the full path to the file to delete (file_to_delete_full_path). The &#8220;command_password&#8221; which the parsed packet data will be compared to. The &#8220;command_port&#8221; is also provided and will be compared to the packet data in the <code>dmesg<\/code> packet entry.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Extracting Packet Data<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>    while True:\n        dmesg_log = subprocess.Popen(&#91;'dmesg'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)\n\n        for line in dmesg_log.stdout.readlines():\n            line = line.decode()\n\n            source_port = re.findall(\"SPT=.*? \", line)\n            if source_port:\n                parsed_source_port = str(source_port&#91;0]).strip().split(\"=\")&#91;1]\n\n            options_password = re.findall(\"OPT .*?\\)\", line)\n            if options_password:\n                parsed_options_password = str(options_password&#91;0]).strip().split(\" \")&#91;1].strip(\")(\")&#91;4:-4]\n                parsed_command_password = binascii.hexlify(command_password.encode()).upper().decode()<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The source port and password (stored in TCP options) are extracted from the packet entry in dmesg for later comparison to the hardcoded values in the server.py script.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Verifying Ports and Passwords<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>if source_port and options_password:\n    try:\n        if parsed_options_password == parsed_command_password and parsed_source_port == command_port:\n            shred_response = subprocess.Popen(&#91;\"shred\", \"-f\", \"-n 1\", \"-u\", file_to_delete_full_path],\n                                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)\n            if shred_response.stdout.readline().decode() in \"failed to open\":\n                sys.exit(0)\n    except Exception as e:\n        print(e)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server.py script verifies that the <code>parsed_options_password<\/code> is equal to the <code>parsed_command_password<\/code> (stored in the script). It then checks whether the packet <code>parsed_source_port<\/code> is equal to the <code>command_port<\/code> (stored in the script).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If these values are both equal, then the <code>shred<\/code> utility is run with parameters indicating which file to delete (<code>file_to_delete_full_path<\/code>). When the script has completed and the file can no longer be found (<code>failed to open<\/code>), the script exits successfully.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Firewall (nftables) Rules<\/h4>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>$ sudo nft add table ip shkval\n$ sudo nft add chain ip shkval input { type filter hook input priority 0\\; }\n$ sudo nft add rule shkval input log level debug log flags all<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These nft rules will output log entries to <code>dmesg<\/code>. These entries will contain the extra TCP options fields, which we are using as a &#8220;password&#8221;. This password is checked against the password stored in the <code>server.py<\/code> script which, when equal, will initiate the shred utility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Download from GitHub: <a href=\"https:\/\/github.com\/ultros\/shkval\/tree\/master\">shkval remote file wiping software<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>git clone https:\/\/github.com\/ultros\/shkval<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.<\/p>\n","protected":false},"author":1,"featured_media":234,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,24],"tags":[35,36,13,40],"class_list":["post-263","post","type-post","status-publish","format-standard","has-post-thumbnail","category-anti-forensics-software","category-software-code","tag-github","tag-iptables","tag-python","tag-scapy"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>shkval - Remote Wiping Software for Linux - Anti-Forensics.com<\/title>\n<meta name=\"description\" content=\"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"shkval - Remote Wiping Software for Linux - Anti-Forensics.com\" \/>\n<meta property=\"og:description\" content=\"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Anti-Forensics.com\" \/>\n<meta property=\"article:author\" content=\"https:\/\/facebook.com\/stercutis\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-19T03:59:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-08T00:23:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"970\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Max\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Max\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/\"},\"author\":{\"name\":\"Max\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/ac3dd160cb42b1409a2a55dea58beec2\"},\"headline\":\"shkval &#8211; Remote Wiping Software for Linux\",\"datePublished\":\"2023-08-19T03:59:01+00:00\",\"dateModified\":\"2024-03-08T00:23:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/\"},\"wordCount\":419,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/anti-forensics-shkval-file-wiper.jpg\",\"keywords\":[\"github\",\"iptables\",\"python\",\"scapy\"],\"articleSection\":[\"Software\",\"Software\\\/Code\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/\",\"name\":\"shkval - Remote Wiping Software for Linux - Anti-Forensics.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/anti-forensics-shkval-file-wiper.jpg\",\"datePublished\":\"2023-08-19T03:59:01+00:00\",\"dateModified\":\"2024-03-08T00:23:47+00:00\",\"description\":\"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/anti-forensics-shkval-file-wiper.jpg\",\"contentUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/anti-forensics-shkval-file-wiper.jpg\",\"width\":1024,\"height\":970},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/shkval-remote-wiping-software-for-linux-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"shkval &#8211; Remote Wiping Software for Linux\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\",\"name\":\"Anti-Forensics.com\",\"description\":\"Rendering Digital Investigations Irrelevant\",\"publisher\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#organization\",\"name\":\"Anti-Forensics.com\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/cropped-anti-forensics.com_.jpg\",\"contentUrl\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/cropped-anti-forensics.com_.jpg\",\"width\":512,\"height\":512,\"caption\":\"Anti-Forensics.com\"},\"image\":{\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/groups\\\/14345620\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/ac3dd160cb42b1409a2a55dea58beec2\",\"name\":\"Max\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g\",\"caption\":\"Max\"},\"description\":\"Anti-forensics involves attempts to hide data, damage the confidentiality, integrity, and availability of data in an effort to make analysis and examination of this data (evidence) difficult or impossible.\",\"sameAs\":[\"https:\\\/\\\/anti-forensics.com\\\/blog\",\"https:\\\/\\\/facebook.com\\\/stercutis\",\"https:\\\/\\\/linkedin.com\\\/in\\\/jesse-shelley\"],\"url\":\"https:\\\/\\\/anti-forensics.com\\\/blog\\\/author\\\/realjesseshelley_hkwwlra2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"shkval - Remote Wiping Software for Linux - Anti-Forensics.com","description":"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/","og_locale":"en_US","og_type":"article","og_title":"shkval - Remote Wiping Software for Linux - Anti-Forensics.com","og_description":"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.","og_url":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/","og_site_name":"Anti-Forensics.com","article_author":"https:\/\/facebook.com\/stercutis","article_published_time":"2023-08-19T03:59:01+00:00","article_modified_time":"2024-03-08T00:23:47+00:00","og_image":[{"width":1024,"height":970,"url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg","type":"image\/jpeg"}],"author":"Max","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Max","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#article","isPartOf":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/"},"author":{"name":"Max","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/person\/ac3dd160cb42b1409a2a55dea58beec2"},"headline":"shkval &#8211; Remote Wiping Software for Linux","datePublished":"2023-08-19T03:59:01+00:00","dateModified":"2024-03-08T00:23:47+00:00","mainEntityOfPage":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/"},"wordCount":419,"commentCount":0,"publisher":{"@id":"https:\/\/anti-forensics.com\/blog\/#organization"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#primaryimage"},"thumbnailUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg","keywords":["github","iptables","python","scapy"],"articleSection":["Software","Software\/Code"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/","url":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/","name":"shkval - Remote Wiping Software for Linux - Anti-Forensics.com","isPartOf":{"@id":"https:\/\/anti-forensics.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#primaryimage"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#primaryimage"},"thumbnailUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg","datePublished":"2023-08-19T03:59:01+00:00","dateModified":"2024-03-08T00:23:47+00:00","description":"shkval is an example of a remote wiping software that can be used on any Linux system utilizing nftables. nft rules are setup on the server so that packet data, including TCP options, are stored in entries logged to dmesg. This means we do not need to bind to a socket to send commands to the system.","breadcrumb":{"@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#primaryimage","url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg","contentUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/anti-forensics-shkval-file-wiper.jpg","width":1024,"height":970},{"@type":"BreadcrumbList","@id":"https:\/\/anti-forensics.com\/blog\/shkval-remote-wiping-software-for-linux-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/anti-forensics.com\/blog\/"},{"@type":"ListItem","position":2,"name":"shkval &#8211; Remote Wiping Software for Linux"}]},{"@type":"WebSite","@id":"https:\/\/anti-forensics.com\/blog\/#website","url":"https:\/\/anti-forensics.com\/blog\/","name":"Anti-Forensics.com","description":"Rendering Digital Investigations Irrelevant","publisher":{"@id":"https:\/\/anti-forensics.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/anti-forensics.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/anti-forensics.com\/blog\/#organization","name":"Anti-Forensics.com","url":"https:\/\/anti-forensics.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/cropped-anti-forensics.com_.jpg","contentUrl":"https:\/\/anti-forensics.com\/blog\/wp-content\/uploads\/2024\/01\/cropped-anti-forensics.com_.jpg","width":512,"height":512,"caption":"Anti-Forensics.com"},"image":{"@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/groups\/14345620\/"]},{"@type":"Person","@id":"https:\/\/anti-forensics.com\/blog\/#\/schema\/person\/ac3dd160cb42b1409a2a55dea58beec2","name":"Max","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7ca31cae39a49ab947496651bc5c75ee545a72f31c02db1a5c31f80b28714601?s=96&d=mm&r=g","caption":"Max"},"description":"Anti-forensics involves attempts to hide data, damage the confidentiality, integrity, and availability of data in an effort to make analysis and examination of this data (evidence) difficult or impossible.","sameAs":["https:\/\/anti-forensics.com\/blog","https:\/\/facebook.com\/stercutis","https:\/\/linkedin.com\/in\/jesse-shelley"],"url":"https:\/\/anti-forensics.com\/blog\/author\/realjesseshelley_hkwwlra2\/"}]}},"_links":{"self":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/comments?post=263"}],"version-history":[{"count":1,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/263\/revisions"}],"predecessor-version":[{"id":292,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/posts\/263\/revisions\/292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/media\/234"}],"wp:attachment":[{"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/media?parent=263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/categories?post=263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anti-forensics.com\/blog\/wp-json\/wp\/v2\/tags?post=263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}