====== Anti-Forensics.com ====== **Digital forensics, anti-forensics detection, artifact interpretation, recovery limits, timeline analysis, and report discipline.** Dead files do not testify. Bad reports do. Anti-Forensics.com is a defensive technical reference for understanding how digital evidence appears, disappears, survives, misleads, and gets overclaimed by people who should know better. This wiki focuses on anti-forensic indicators, forensic artifacts, storage behavior, timeline reconstruction, evidence preservation, and the ugly little gap between what a trace shows and what someone wants it to prove. This is not a guide for hiding, destroying, altering, or tampering with evidence. It is a reference for analysts, investigators, incident responders, students, and technically curious readers who want to understand anti-forensics without turning the server into a shovel rack. ===== Main Index ===== * [[:wiki:anti_forensics:detection:start|Anti-Forensics Detection]] * [[:wiki:digital_forensics:foundations:start|Digital Forensics Foundations]] * [[:wiki:digital_forensics:file_systems:start|File Systems and Storage Artifacts]] * [[:wiki:digital_forensics:windows:start|Windows Artifacts]] * [[:wiki:digital_forensics:logs_timelines:start|Logs and Timelines]] * [[:wiki:digital_forensics:browser_mobile_cloud:start|Browser, Mobile, and Cloud Artifacts]] * [[:wiki:digital_forensics:linux_macos:start|Linux and macOS Artifacts]] * [[:wiki:digital_forensics:memory_malware_ir:start|Memory, Malware, and Incident Response]] * [[:wiki:forensic_checklists:start|Forensic Checklists]] * [[:wiki:tools:start|Tools]] * [[:wiki:resources:start|Resources]] * [[:wiki:support|Support]] ===== Start Here ===== For new readers, begin with the foundation pages before wandering into the basement with the deleted files. - [[:wiki:digital_forensics:foundations:digital_evidence|Digital Evidence]] - [[:wiki:digital_forensics:foundations:evidence_preservation|Evidence Preservation]] - [[:wiki:digital_forensics:foundations:forensic_imaging|Forensic Imaging]] - [[:wiki:digital_forensics:foundations:hash_verification|Hash Verification]] - [[:wiki:digital_forensics:foundations:artifact_corroboration|Artifact Corroboration]] - [[:wiki:digital_forensics:foundations:intent_analysis_limits|Intent Analysis Limits]] - [[:wiki:digital_forensics:foundations:timeline_reconstruction|Timeline Reconstruction]] - [[:wiki:digital_forensics:foundations:report_review|Report Review]] ===== What This Wiki Covers ===== Anti-forensics is often treated like a dramatic dark art. In real cases, it is usually less theatrical and more irritating: wiped remnants, log gaps, misleading timestamps, recovery failure, cloud sync weirdness, cleanup utilities, encryption, privacy tools, missing metadata, and examiners staring at unallocated space like it owes them a confession. This wiki is organized around practical forensic questions: * What was actually observed? * What can this artifact support? * What can it **not** prove by itself? * What normal system behavior could explain it? * What other evidence should be compared? * How should this be written without turning the report into a loaded weapon? The goal is not to make every artifact look guilty. The goal is to stop bad conclusions from crawling out of the evidence locker wearing a little expert-witness hat. ===== Featured Entries ===== ^ Topic ^ Why It Matters ^ | [[:wiki:anti_forensics:detection:secure_deletion|Secure Deletion]] | A missing file may matter, but failed recovery is not a confession. Sometimes the file was wiped. Sometimes the SSD did what SSDs do. | | [[:wiki:anti_forensics:detection:recovery_failure|Recovery Failure]] | Recovery failure can be meaningful, boring, suspicious, or all three while wearing the same coat. | | [[:wiki:digital_forensics:file_systems:file_carving|File Carving]] | Useful for recovery, dangerous when treated like full context. A carved fragment does not arrive with a signed statement. | | [[:wiki:digital_forensics:file_systems:ssd_trim|SSD TRIM]] | TRIM can make deleted data unrecoverable without anyone performing ceremonial evidence burial. | | [[:wiki:digital_forensics:file_systems:unallocated_space|Unallocated Space]] | The graveyard of deleted data, half-truths, fragments, and examiner overconfidence. | | [[:wiki:anti_forensics:detection:timestamp_manipulation|Timestamp Manipulation]] | Timestamps can lie, drift, inherit, normalize, or get changed. Treat them like witnesses with alibis and bad shoes. | | [[:wiki:digital_forensics:windows:windows_prefetch|Windows Prefetch]] | Useful execution evidence, but not proof that a specific human knowingly performed the action. | | [[:wiki:digital_forensics:windows:shellbags|Shellbags]] | Folder interaction artifacts are useful, but they still need context before being dragged into court. | | [[:wiki:digital_forensics:foundations:artifact_corroboration|Artifact Corroboration]] | One artifact makes a suggestion. Independent artifacts make a case. Sometimes. If they behave. | | [[:wiki:digital_forensics:foundations:intent_analysis_limits|Intent Analysis Limits]] | Intent is not carved out of unallocated space with a spoon. It needs context, corroboration, and restraint. | ===== Anti-Forensics Detection ===== * [[:wiki:anti_forensics:detection:anti_forensics|Anti-Forensics]] * [[:wiki:anti_forensics:detection:anti_forensic_file_wiping|Anti-Forensic File Wiping]] * [[:wiki:anti_forensics:detection:file_wiping|File Wiping]] * [[:wiki:anti_forensics:detection:secure_deletion|Secure Deletion]] * [[:wiki:anti_forensics:detection:wiped_free_space|Wiped Free Space]] * [[:wiki:anti_forensics:detection:recovery_failure|Recovery Failure]] * [[:wiki:anti_forensics:detection:artifact_deletion|Artifact Deletion]] * [[:wiki:anti_forensics:detection:artifact_gaps|Artifact Gaps]] * [[:wiki:anti_forensics:detection:evidence_destruction_claims|Evidence Destruction Claims]] * [[:wiki:anti_forensics:detection:cleanup_utility_artifacts|Cleanup Utility Artifacts]] * [[:wiki:anti_forensics:detection:privacy_tool_artifacts|Privacy Tool Artifacts]] * [[:wiki:anti_forensics:detection:private_browsing_artifacts|Private Browsing Artifacts]] * [[:wiki:anti_forensics:detection:browser_anti_forensics|Browser Anti-Forensics]] * [[:wiki:anti_forensics:detection:cloud_deletion_artifacts|Cloud Deletion Artifacts]] * [[:wiki:anti_forensics:detection:mobile_deletion_artifacts|Mobile Deletion Artifacts]] * [[:wiki:anti_forensics:detection:log_tampering|Log Tampering]] * [[:wiki:anti_forensics:detection:log_gaps|Log Gaps]] * [[:wiki:anti_forensics:detection:metadata_manipulation|Metadata Manipulation]] * [[:wiki:anti_forensics:detection:timestamp_manipulation|Timestamp Manipulation]] * [[:wiki:anti_forensics:detection:timestomping|Timestomping]] * [[:wiki:anti_forensics:detection:clock_manipulation|Clock Manipulation]] * [[:wiki:anti_forensics:detection:timeline_poisoning|Timeline Poisoning]] * [[:wiki:anti_forensics:detection:data_hiding|Data Hiding]] * [[:wiki:anti_forensics:detection:steganography|Steganography]] * [[:wiki:anti_forensics:detection:compression_as_concealment|Compression as Concealment]] * [[:wiki:anti_forensics:detection:alternate_data_stream_abuse|Alternate Data Stream Abuse]] * [[:wiki:anti_forensics:detection:extension_mismatch|Extension Mismatch]] * [[:wiki:anti_forensics:detection:mime_type_mismatch|MIME Type Mismatch]] * [[:wiki:anti_forensics:detection:file_name_spoofing|File Name Spoofing]] * [[:wiki:anti_forensics:detection:renaming_and_moving_files|Renaming and Moving Files]] * [[:wiki:anti_forensics:detection:encrypted_containers_in_investigations|Encrypted Containers in Investigations]] * [[:wiki:anti_forensics:detection:encryption_in_investigations|Encryption in Investigations]] * [[:wiki:anti_forensics:detection:full_disk_encryption|Full Disk Encryption]] * [[:wiki:anti_forensics:detection:plausible_deniability_claims|Plausible Deniability Claims]] * [[:wiki:anti_forensics:detection:anti_debugging_indicators|Anti-Debugging Indicators]] * [[:wiki:anti_forensics:detection:process_injection_traces|Process Injection Traces]] * [[:wiki:anti_forensics:detection:sandbox_evasion_indicators|Sandbox Evasion Indicators]] * [[:wiki:anti_forensics:detection:self_deleting_malware|Self-Deleting Malware]] * [[:wiki:anti_forensics:detection:virtual_machine_artifacts|Virtual Machine Artifacts]] * [[:wiki:anti_forensics:detection:benign_explanations_in_anti_forensics|Benign Explanations in Anti-Forensics]] ===== Digital Forensics Foundations ===== * [[:wiki:digital_forensics:foundations:digital_forensics|Digital Forensics]] * [[:wiki:digital_forensics:foundations:digital_evidence|Digital Evidence]] * [[:wiki:digital_forensics:foundations:evidence_integrity|Evidence Integrity]] * [[:wiki:digital_forensics:foundations:evidence_preservation|Evidence Preservation]] * [[:wiki:digital_forensics:foundations:evidence_packaging|Evidence Packaging]] * [[:wiki:digital_forensics:foundations:evidence_transfer|Evidence Transfer]] * [[:wiki:digital_forensics:foundations:chain_of_custody|Chain of Custody]] * [[:wiki:digital_forensics:foundations:forensic_imaging|Forensic Imaging]] * [[:wiki:digital_forensics:foundations:write_blocking|Write Blocking]] * [[:wiki:digital_forensics:foundations:hash_verification|Hash Verification]] * [[:wiki:digital_forensics:foundations:forensic_soundness|Forensic Soundness]] * [[:wiki:digital_forensics:foundations:forensic_triage|Forensic Triage]] * [[:wiki:digital_forensics:foundations:live_response|Live Response]] * [[:wiki:digital_forensics:foundations:dead_box_analysis|Dead Box Analysis]] * [[:wiki:digital_forensics:foundations:volatile_data|Volatile Data]] * [[:wiki:digital_forensics:foundations:nonvolatile_data|Nonvolatile Data]] * [[:wiki:digital_forensics:foundations:working_copies|Working Copies]] * [[:wiki:digital_forensics:foundations:case_notes|Case Notes]] * [[:wiki:digital_forensics:foundations:case_chronology|Case Chronology]] * [[:wiki:digital_forensics:foundations:forensic_documentation|Forensic Documentation]] * [[:wiki:digital_forensics:foundations:artifact_corroboration|Artifact Corroboration]] * [[:wiki:digital_forensics:foundations:collection_bias|Collection Bias]] * [[:wiki:digital_forensics:foundations:false_positives|False Positives]] * [[:wiki:digital_forensics:foundations:false_negatives|False Negatives]] * [[:wiki:digital_forensics:foundations:intent_analysis_limits|Intent Analysis Limits]] * [[:wiki:digital_forensics:foundations:user_attribution|User Attribution]] * [[:wiki:digital_forensics:foundations:source_attribution|Source Attribution]] * [[:wiki:digital_forensics:foundations:metadata|Metadata]] * [[:wiki:digital_forensics:foundations:timeline_reconstruction|Timeline Reconstruction]] * [[:wiki:digital_forensics:foundations:time_normalization|Time Normalization]] * [[:wiki:digital_forensics:foundations:parser_validation|Parser Validation]] * [[:wiki:digital_forensics:foundations:tool_verification|Tool Verification]] * [[:wiki:digital_forensics:foundations:repeatability|Repeatability]] * [[:wiki:digital_forensics:foundations:peer_review|Peer Review]] * [[:wiki:digital_forensics:foundations:report_review|Report Review]] * [[:wiki:digital_forensics:foundations:scope_control|Scope Control]] * [[:wiki:digital_forensics:foundations:privilege_review|Privilege Review]] * [[:wiki:digital_forensics:foundations:legal_hold|Legal Hold]] * [[:wiki:digital_forensics:foundations:expert_handoff|Expert Handoff]] ===== File Systems and Storage Artifacts ===== * [[:wiki:digital_forensics:file_systems:file_systems|File Systems]] * [[:wiki:digital_forensics:file_systems:ntfs|NTFS]] * [[:wiki:digital_forensics:file_systems:exfat|exFAT]] * [[:wiki:digital_forensics:file_systems:ext4|ext4]] * [[:wiki:digital_forensics:file_systems:apfs|APFS]] * [[:wiki:digital_forensics:file_systems:hfs_plus|HFS Plus]] * [[:wiki:digital_forensics:file_systems:btrfs|Btrfs]] * [[:wiki:digital_forensics:file_systems:xfs|XFS]] * [[:wiki:digital_forensics:file_systems:file_carving|File Carving]] * [[:wiki:digital_forensics:file_systems:carving_false_positives|Carving False Positives]] * [[:wiki:digital_forensics:file_systems:file_signatures|File Signatures]] * [[:wiki:digital_forensics:file_systems:data_remanence|Data Remanence]] * [[:wiki:digital_forensics:file_systems:deleted_files|Deleted Files]] * [[:wiki:digital_forensics:file_systems:unallocated_space|Unallocated Space]] * [[:wiki:digital_forensics:file_systems:slack_space|Slack Space]] * [[:wiki:digital_forensics:file_systems:overwriting|Overwriting]] * [[:wiki:digital_forensics:file_systems:ssd_trim|SSD TRIM]] * [[:wiki:digital_forensics:file_systems:wear_leveling|Wear Leveling]] * [[:wiki:digital_forensics:file_systems:file_fragmentation|File Fragmentation]] * [[:wiki:digital_forensics:file_systems:cluster_allocation|Cluster Allocation]] * [[:wiki:digital_forensics:file_systems:directory_entries|Directory Entries]] * [[:wiki:digital_forensics:file_systems:file_metadata|File Metadata]] * [[:wiki:digital_forensics:file_systems:file_system_timestamps|File System Timestamps]] * [[:wiki:digital_forensics:file_systems:created_modified_accessed_times|Created, Modified, Accessed Times]] * [[:wiki:digital_forensics:file_systems:mac_timestamps|MAC Timestamps]] * [[:wiki:digital_forensics:file_systems:time_zone_effects|Time Zone Effects]] * [[:wiki:digital_forensics:file_systems:file_system_journaling|File System Journaling]] * [[:wiki:digital_forensics:file_systems:master_file_table|Master File Table]] * [[:wiki:digital_forensics:file_systems:standard_information_attribute|Standard Information Attribute]] * [[:wiki:digital_forensics:file_systems:file_name_attribute|File Name Attribute]] * [[:wiki:digital_forensics:file_systems:usn_journal|USN Journal]] * [[:wiki:digital_forensics:file_systems:recycle_bin_artifacts|Recycle Bin Artifacts]] * [[:wiki:digital_forensics:file_systems:thumbnail_caches|Thumbnail Caches]] * [[:wiki:digital_forensics:file_systems:recent_files|Recent Files]] * [[:wiki:digital_forensics:file_systems:temporary_files|Temporary Files]] * [[:wiki:digital_forensics:file_systems:trash_folders|Trash Folders]] * [[:wiki:digital_forensics:file_systems:restore_points|Restore Points]] * [[:wiki:digital_forensics:file_systems:volume_shadow_copies|Volume Shadow Copies]] * [[:wiki:digital_forensics:file_systems:encrypted_containers|Encrypted Containers]] * [[:wiki:digital_forensics:file_systems:archive_files|Archive Files]] * [[:wiki:digital_forensics:file_systems:sparse_files|Sparse Files]] * [[:wiki:digital_forensics:file_systems:hard_links|Hard Links]] * [[:wiki:digital_forensics:file_systems:symbolic_links|Symbolic Links]] * [[:wiki:digital_forensics:file_systems:reparse_points|Reparse Points]] * [[:wiki:digital_forensics:file_systems:file_rename_artifacts|File Rename Artifacts]] * [[:wiki:digital_forensics:file_systems:copy_operation_artifacts|Copy Operation Artifacts]] * [[:wiki:digital_forensics:file_systems:move_operation_artifacts|Move Operation Artifacts]] * [[:wiki:digital_forensics:file_systems:partition_tables|Partition Tables]] * [[:wiki:digital_forensics:file_systems:master_boot_record|Master Boot Record]] * [[:wiki:digital_forensics:file_systems:guid_partition_table|GUID Partition Table]] * [[:wiki:digital_forensics:file_systems:disk_images|Disk Images]] * [[:wiki:digital_forensics:file_systems:bad_sectors|Bad Sectors]] ===== Windows Artifacts ===== * [[:wiki:digital_forensics:windows:windows_event_logs|Windows Event Logs]] * [[:wiki:digital_forensics:windows:security_event_log|Security Event Log]] * [[:wiki:digital_forensics:windows:system_event_log|System Event Log]] * [[:wiki:digital_forensics:windows:application_event_log|Application Event Log]] * [[:wiki:digital_forensics:windows:event_log_clearing|Event Log Clearing]] * [[:wiki:digital_forensics:windows:sysmon_events|Sysmon Events]] * [[:wiki:digital_forensics:windows:windows_prefetch|Windows Prefetch]] * [[:wiki:digital_forensics:windows:prefetch_run_counts|Prefetch Run Counts]] * [[:wiki:digital_forensics:windows:amcache|Amcache]] * [[:wiki:digital_forensics:windows:shimcache|Shimcache]] * [[:wiki:digital_forensics:windows:appcompatcache|AppCompatCache]] * [[:wiki:digital_forensics:windows:jump_lists|Jump Lists]] * [[:wiki:digital_forensics:windows:lnk_files|LNK Files]] * [[:wiki:digital_forensics:windows:shellbags|Shellbags]] * [[:wiki:digital_forensics:windows:thumbcache|Thumbcache]] * [[:wiki:digital_forensics:windows:iconcache|IconCache]] * [[:wiki:digital_forensics:windows:recentdocs|RecentDocs]] * [[:wiki:digital_forensics:windows:opensavemru|OpenSaveMRU]] * [[:wiki:digital_forensics:windows:runmru|RunMRU]] * [[:wiki:digital_forensics:windows:typedpaths|TypedPaths]] * [[:wiki:digital_forensics:windows:wordwheelquery|WordWheelQuery]] * [[:wiki:digital_forensics:windows:userassist|UserAssist]] * [[:wiki:digital_forensics:windows:recycle_bin_on_windows|Recycle Bin on Windows]] * [[:wiki:digital_forensics:windows:registry_hives|Registry Hives]] * [[:wiki:digital_forensics:windows:windows_registry|Windows Registry]] * [[:wiki:digital_forensics:windows:ntuser_dat|NTUSER.DAT]] * [[:wiki:digital_forensics:windows:sam_hive|SAM Hive]] * [[:wiki:digital_forensics:windows:security_hive|Security Hive]] * [[:wiki:digital_forensics:windows:software_hive|Software Hive]] * [[:wiki:digital_forensics:windows:system_hive|SYSTEM Hive]] * [[:wiki:digital_forensics:windows:mounteddevices|MountedDevices]] * [[:wiki:digital_forensics:windows:usb_device_history|USB Device History]] * [[:wiki:digital_forensics:windows:setupapi_logs|SetupAPI Logs]] * [[:wiki:digital_forensics:windows:powershell_logs|PowerShell Logs]] * [[:wiki:digital_forensics:windows:powershell_script_block_logging|PowerShell Script Block Logging]] * [[:wiki:digital_forensics:windows:scheduled_tasks|Scheduled Tasks]] * [[:wiki:digital_forensics:windows:run_keys|Run Keys]] * [[:wiki:digital_forensics:windows:startup_folders|Startup Folders]] * [[:wiki:digital_forensics:windows:windows_services|Windows Services]] * [[:wiki:digital_forensics:windows:service_control_manager_events|Service Control Manager Events]] * [[:wiki:digital_forensics:windows:bits_jobs|BITS Jobs]] * [[:wiki:digital_forensics:windows:rdp_artifacts|RDP Artifacts]] * [[:wiki:digital_forensics:windows:terminal_services_logs|Terminal Services Logs]] * [[:wiki:digital_forensics:windows:onedrive_artifacts|OneDrive Artifacts]] * [[:wiki:digital_forensics:windows:outlook_ost_files|Outlook OST Files]] * [[:wiki:digital_forensics:windows:teams_artifacts_on_windows|Teams Artifacts on Windows]] * [[:wiki:digital_forensics:windows:windows_defender_logs|Windows Defender Logs]] * [[:wiki:digital_forensics:windows:windows_firewall_logs|Windows Firewall Logs]] * [[:wiki:digital_forensics:windows:windows_update_logs|Windows Update Logs]] * [[:wiki:digital_forensics:windows:windows_time_service_logs|Windows Time Service Logs]] * [[:wiki:digital_forensics:windows:windows_search_database|Windows Search Database]] * [[:wiki:digital_forensics:windows:windows_timeline_activity|Windows Timeline Activity]] * [[:wiki:digital_forensics:windows:ntfs_change_journal|NTFS Change Journal]] * [[:wiki:digital_forensics:windows:volume_shadow_copy_on_windows|Volume Shadow Copy on Windows]] * [[:wiki:digital_forensics:windows:wmi_persistence|WMI Persistence]] * [[:wiki:digital_forensics:windows:bam_and_dam|BAM and DAM]] * [[:wiki:digital_forensics:windows:muicache|MUICache]] * [[:wiki:digital_forensics:windows:program_compatibility_assistant|Program Compatibility Assistant]] * [[:wiki:digital_forensics:windows:cloud_clipboard_artifacts|Cloud Clipboard Artifacts]] ===== Logs and Timelines ===== * [[:wiki:digital_forensics:logs_timelines:timeline_analysis|Timeline Analysis]] * [[:wiki:digital_forensics:logs_timelines:super_timeline|Super Timeline]] * [[:wiki:digital_forensics:logs_timelines:event_sequencing|Event Sequencing]] * [[:wiki:digital_forensics:logs_timelines:timeline_contradictions|Timeline Contradictions]] * [[:wiki:digital_forensics:logs_timelines:report_timeline_exhibits|Report Timeline Exhibits]] * [[:wiki:digital_forensics:logs_timelines:time_source_validation|Time Source Validation]] * [[:wiki:digital_forensics:logs_timelines:time_zone_normalization|Time Zone Normalization]] * [[:wiki:digital_forensics:logs_timelines:clock_drift|Clock Drift]] * [[:wiki:digital_forensics:logs_timelines:manual_time_changes|Manual Time Changes]] * [[:wiki:digital_forensics:logs_timelines:ntp_records|NTP Records]] * [[:wiki:digital_forensics:logs_timelines:collection_time_effects|Collection Time Effects]] * [[:wiki:digital_forensics:logs_timelines:duplicate_timestamps|Duplicate Timestamps]] * [[:wiki:digital_forensics:logs_timelines:event_record_ids|Event Record IDs]] * [[:wiki:digital_forensics:logs_timelines:sequence_gaps|Sequence Gaps]] * [[:wiki:digital_forensics:logs_timelines:missing_logs|Missing Logs]] * [[:wiki:digital_forensics:logs_timelines:log_clearing|Log Clearing]] * [[:wiki:digital_forensics:logs_timelines:log_retention|Log Retention]] * [[:wiki:digital_forensics:logs_timelines:log_rotation|Log Rotation]] * [[:wiki:digital_forensics:logs_timelines:tamper_indicators|Tamper Indicators]] * [[:wiki:digital_forensics:logs_timelines:authentication_logs|Authentication Logs]] * [[:wiki:digital_forensics:logs_timelines:account_logon_events|Account Logon Events]] * [[:wiki:digital_forensics:logs_timelines:process_creation_logs|Process Creation Logs]] * [[:wiki:digital_forensics:logs_timelines:boot_time_artifacts|Boot Time Artifacts]] * [[:wiki:digital_forensics:logs_timelines:shutdown_events|Shutdown Events]] * [[:wiki:digital_forensics:logs_timelines:sleep_wake_events|Sleep/Wake Events]] * [[:wiki:digital_forensics:logs_timelines:network_connection_logs|Network Connection Logs]] * [[:wiki:digital_forensics:logs_timelines:dns_logs|DNS Logs]] * [[:wiki:digital_forensics:logs_timelines:firewall_logs|Firewall Logs]] * [[:wiki:digital_forensics:logs_timelines:proxy_logs|Proxy Logs]] * [[:wiki:digital_forensics:logs_timelines:vpn_logs|VPN Logs]] * [[:wiki:digital_forensics:logs_timelines:edr_telemetry|EDR Telemetry]] * [[:wiki:digital_forensics:logs_timelines:siem_events|SIEM Events]] * [[:wiki:digital_forensics:logs_timelines:cloud_audit_timelines|Cloud Audit Timelines]] * [[:wiki:digital_forensics:logs_timelines:cross_host_correlation|Cross-Host Correlation]] * [[:wiki:digital_forensics:logs_timelines:retention_policy_effects|Retention Policy Effects]] ===== Browser, Mobile, and Cloud Artifacts ===== * [[:wiki:digital_forensics:browser_mobile_cloud:account_login_history|Account Login History]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_history|Browser History]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_downloads|Browser Downloads]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_cache|Browser Cache]] * [[:wiki:digital_forensics:browser_mobile_cloud:web_cache|Web Cache]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_cookies|Browser Cookies]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_sessions|Browser Sessions]] * [[:wiki:digital_forensics:browser_mobile_cloud:browser_extensions|Browser Extensions]] * [[:wiki:digital_forensics:browser_mobile_cloud:private_browsing|Private Browsing]] * [[:wiki:digital_forensics:browser_mobile_cloud:search_history|Search History]] * [[:wiki:digital_forensics:browser_mobile_cloud:autofill_artifacts|Autofill Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:saved_password_artifacts|Saved Password Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:chrome_profile_artifacts|Chrome Profile Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:firefox_profile_artifacts|Firefox Profile Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:edge_profile_artifacts|Edge Profile Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:safari_artifacts|Safari Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:tor_browser_artifacts|Tor Browser Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:dns_cache|DNS Cache]] * [[:wiki:digital_forensics:browser_mobile_cloud:email_headers|Email Headers]] * [[:wiki:digital_forensics:browser_mobile_cloud:message_trace_logs|Message Trace Logs]] * [[:wiki:digital_forensics:browser_mobile_cloud:mailbox_audit_logs|Mailbox Audit Logs]] * [[:wiki:digital_forensics:browser_mobile_cloud:chat_application_artifacts|Chat Application Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:message_attachments|Message Attachments]] * [[:wiki:digital_forensics:browser_mobile_cloud:deleted_message_remnants|Deleted Message Remnants]] * [[:wiki:digital_forensics:browser_mobile_cloud:cloud_sync_artifacts|Cloud Sync Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:cloud_audit_logs|Cloud Audit Logs]] * [[:wiki:digital_forensics:browser_mobile_cloud:cloud_export_files|Cloud Export Files]] * [[:wiki:digital_forensics:browser_mobile_cloud:cloud_recycle_bins|Cloud Recycle Bins]] * [[:wiki:digital_forensics:browser_mobile_cloud:cloud_sharing_history|Cloud Sharing History]] * [[:wiki:digital_forensics:browser_mobile_cloud:cross_device_sync|Cross-Device Sync]] * [[:wiki:digital_forensics:browser_mobile_cloud:google_account_activity|Google Account Activity]] * [[:wiki:digital_forensics:browser_mobile_cloud:google_drive_artifacts|Google Drive Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:microsoft_account_activity|Microsoft Account Activity]] * [[:wiki:digital_forensics:browser_mobile_cloud:onedrive_cloud_artifacts|OneDrive Cloud Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:dropbox_artifacts|Dropbox Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:apple_icloud_artifacts|Apple iCloud Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:oauth_application_grants|OAuth Application Grants]] * [[:wiki:digital_forensics:browser_mobile_cloud:mfa_app_artifacts|MFA App Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:device_enrollment_records|Device Enrollment Records]] * [[:wiki:digital_forensics:browser_mobile_cloud:mobile_device_forensics|Mobile Device Forensics]] * [[:wiki:digital_forensics:browser_mobile_cloud:mobile_app_permissions|Mobile App Permissions]] * [[:wiki:digital_forensics:browser_mobile_cloud:mobile_backup_residue|Mobile Backup Residue]] * [[:wiki:digital_forensics:browser_mobile_cloud:android_app_data|Android App Data]] * [[:wiki:digital_forensics:browser_mobile_cloud:android_browser_artifacts|Android Browser Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:android_downloads|Android Downloads]] * [[:wiki:digital_forensics:browser_mobile_cloud:android_notifications|Android Notifications]] * [[:wiki:digital_forensics:browser_mobile_cloud:android_usage_stats|Android Usage Stats]] * [[:wiki:digital_forensics:browser_mobile_cloud:ios_backups|iOS Backups]] * [[:wiki:digital_forensics:browser_mobile_cloud:ios_backup_manifest|iOS Backup Manifest]] * [[:wiki:digital_forensics:browser_mobile_cloud:ios_knowledgec_database|iOS KnowledgeC Database]] * [[:wiki:digital_forensics:browser_mobile_cloud:ios_location_artifacts|iOS Location Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:ios_unified_logs|iOS Unified Logs]] * [[:wiki:digital_forensics:browser_mobile_cloud:mobile_photo_metadata|Mobile Photo Metadata]] * [[:wiki:digital_forensics:browser_mobile_cloud:push_notification_artifacts|Push Notification Artifacts]] * [[:wiki:digital_forensics:browser_mobile_cloud:sqlite_app_databases|SQLite App Databases]] ===== Linux and macOS Artifacts ===== * [[:wiki:digital_forensics:linux_macos:bash_history|Bash History]] * [[:wiki:digital_forensics:linux_macos:zsh_history|Zsh History]] * [[:wiki:digital_forensics:linux_macos:terminal_history|Terminal History]] * [[:wiki:digital_forensics:linux_macos:shell_configuration_files|Shell Configuration Files]] * [[:wiki:digital_forensics:linux_macos:ssh_authorized_keys|SSH Authorized Keys]] * [[:wiki:digital_forensics:linux_macos:ssh_known_hosts|SSH Known Hosts]] * [[:wiki:digital_forensics:linux_macos:linux_auth_logs|Linux Auth Logs]] * [[:wiki:digital_forensics:linux_macos:linux_auditd|Linux auditd]] * [[:wiki:digital_forensics:linux_macos:linux_package_logs|Linux Package Logs]] * [[:wiki:digital_forensics:linux_macos:linux_inodes|Linux Inodes]] * [[:wiki:digital_forensics:linux_macos:linux_trash|Linux Trash]] * [[:wiki:digital_forensics:linux_macos:cron_jobs|Cron Jobs]] * [[:wiki:digital_forensics:linux_macos:systemd_journal|systemd Journal]] * [[:wiki:digital_forensics:linux_macos:systemd_timers|systemd Timers]] * [[:wiki:digital_forensics:linux_macos:sudo_logs|Sudo Logs]] * [[:wiki:digital_forensics:linux_macos:user_login_records|User Login Records]] * [[:wiki:digital_forensics:linux_macos:unix_timestamp_conversion|Unix Timestamp Conversion]] * [[:wiki:digital_forensics:linux_macos:file_permissions|File Permissions]] * [[:wiki:digital_forensics:linux_macos:extended_attributes|Extended Attributes]] * [[:wiki:digital_forensics:linux_macos:plist_files|Plist Files]] * [[:wiki:digital_forensics:linux_macos:launchagents|LaunchAgents]] * [[:wiki:digital_forensics:linux_macos:launchdaemons|LaunchDaemons]] * [[:wiki:digital_forensics:linux_macos:gatekeeper|Gatekeeper]] * [[:wiki:digital_forensics:linux_macos:keychain_artifacts|Keychain Artifacts]] * [[:wiki:digital_forensics:linux_macos:macos_unified_logs|macOS Unified Logs]] * [[:wiki:digital_forensics:linux_macos:loginwindow_logs|loginwindow Logs]] * [[:wiki:digital_forensics:linux_macos:fsevents|FSEvents]] * [[:wiki:digital_forensics:linux_macos:spotlight_metadata|Spotlight Metadata]] * [[:wiki:digital_forensics:linux_macos:quarantine_events|Quarantine Events]] * [[:wiki:digital_forensics:linux_macos:macos_recent_items|macOS Recent Items]] * [[:wiki:digital_forensics:linux_macos:macos_trash|macOS Trash]] * [[:wiki:digital_forensics:linux_macos:apfs_snapshots|APFS Snapshots]] * [[:wiki:digital_forensics:linux_macos:time_machine_backups|Time Machine Backups]] * [[:wiki:digital_forensics:linux_macos:homebrew_logs|Homebrew Logs]] * [[:wiki:digital_forensics:linux_macos:sleep_wake_logs|Sleep/Wake Logs]] ===== Memory, Malware, and Incident Response ===== * [[:wiki:digital_forensics:memory_malware_ir:memory_acquisition|Memory Acquisition]] * [[:wiki:digital_forensics:memory_malware_ir:memory_images|Memory Images]] * [[:wiki:digital_forensics:memory_malware_ir:volatility_analysis|Volatility Analysis]] * [[:wiki:digital_forensics:memory_malware_ir:process_lists|Process Lists]] * [[:wiki:digital_forensics:memory_malware_ir:process_trees|Process Trees]] * [[:wiki:digital_forensics:memory_malware_ir:open_handles|Open Handles]] * [[:wiki:digital_forensics:memory_malware_ir:loaded_dlls|Loaded DLLs]] * [[:wiki:digital_forensics:memory_malware_ir:network_sockets_in_memory|Network Sockets in Memory]] * [[:wiki:digital_forensics:memory_malware_ir:registry_hives_in_memory|Registry Hives in Memory]] * [[:wiki:digital_forensics:memory_malware_ir:encryption_keys_in_memory|Encryption Keys in Memory]] * [[:wiki:digital_forensics:memory_malware_ir:credential_artifacts|Credential Artifacts]] * [[:wiki:digital_forensics:memory_malware_ir:injected_code|Injected Code]] * [[:wiki:digital_forensics:memory_malware_ir:process_hollowing|Process Hollowing]] * [[:wiki:digital_forensics:memory_malware_ir:fileless_malware|Fileless Malware]] * [[:wiki:digital_forensics:memory_malware_ir:memory_only_malware|Memory-Only Malware]] * [[:wiki:digital_forensics:memory_malware_ir:malware_triage|Malware Triage]] * [[:wiki:digital_forensics:memory_malware_ir:static_malware_analysis|Static Malware Analysis]] * [[:wiki:digital_forensics:memory_malware_ir:dynamic_malware_analysis|Dynamic Malware Analysis]] * [[:wiki:digital_forensics:memory_malware_ir:sandbox_analysis|Sandbox Analysis]] * [[:wiki:digital_forensics:memory_malware_ir:anti_debugging|Anti-Debugging]] * [[:wiki:digital_forensics:memory_malware_ir:anti_vm_checks|Anti-VM Checks]] * [[:wiki:digital_forensics:memory_malware_ir:sleep_delays|Sleep Delays]] * [[:wiki:digital_forensics:memory_malware_ir:packed_malware|Packed Malware]] * [[:wiki:digital_forensics:memory_malware_ir:obfuscated_code|Obfuscated Code]] * [[:wiki:digital_forensics:memory_malware_ir:api_hashing|API Hashing]] * [[:wiki:digital_forensics:memory_malware_ir:autoruns|Autoruns]] * [[:wiki:digital_forensics:memory_malware_ir:persistence_mechanisms|Persistence Mechanisms]] * [[:wiki:digital_forensics:memory_malware_ir:scheduled_task_persistence|Scheduled Task Persistence]] * [[:wiki:digital_forensics:memory_malware_ir:service_persistence|Service Persistence]] * [[:wiki:digital_forensics:memory_malware_ir:wmi_event_consumers|WMI Event Consumers]] * [[:wiki:digital_forensics:memory_malware_ir:command_line_artifacts|Command Line Artifacts]] * [[:wiki:digital_forensics:memory_malware_ir:powershell_remnants|PowerShell Remnants]] * [[:wiki:digital_forensics:memory_malware_ir:remote_execution_artifacts|Remote Execution Artifacts]] * [[:wiki:digital_forensics:memory_malware_ir:lateral_movement_artifacts|Lateral Movement Artifacts]] * [[:wiki:digital_forensics:memory_malware_ir:temporary_staging_files|Temporary Staging Files]] * [[:wiki:digital_forensics:memory_malware_ir:beaconing|Beaconing]] * [[:wiki:digital_forensics:memory_malware_ir:command_and_control_traffic|Command and Control Traffic]] * [[:wiki:digital_forensics:memory_malware_ir:indicators_of_compromise|Indicators of Compromise]] * [[:wiki:digital_forensics:memory_malware_ir:sigma_rules|Sigma Rules]] * [[:wiki:digital_forensics:memory_malware_ir:yara_rules|YARA Rules]] * [[:wiki:digital_forensics:memory_malware_ir:edr_case_exports|EDR Case Exports]] * [[:wiki:digital_forensics:memory_malware_ir:endpoint_isolation|Endpoint Isolation]] * [[:wiki:digital_forensics:memory_malware_ir:containment_notes|Containment Notes]] * [[:wiki:digital_forensics:memory_malware_ir:forensic_triage_in_incidents|Forensic Triage in Incidents]] * [[:wiki:digital_forensics:memory_malware_ir:incident_handoff|Incident Handoff]] ===== Forensic Checklists ===== * [[:wiki:forensic_checklists:first_response_checklist|First Response Checklist]] * [[:wiki:forensic_checklists:evidence_collection_checklist|Evidence Collection Checklist]] * [[:wiki:forensic_checklists:anti_forensics_review_checklist|Anti-Forensics Review Checklist]] * [[:wiki:forensic_checklists:timeline_review_checklist|Timeline Review Checklist]] * [[:wiki:forensic_checklists:report_review_checklist|Report Review Checklist]] * [[:wiki:forensic_checklists:peer_review_checklist|Peer Review Checklist]] * [[:wiki:forensic_checklists:tool_validation_checklist|Tool Validation Checklist]] * [[:wiki:forensic_checklists:windows_triage_checklist|Windows Triage Checklist]] * [[:wiki:forensic_checklists:linux_triage_checklist|Linux Triage Checklist]] * [[:wiki:forensic_checklists:macos_triage_checklist|macOS Triage Checklist]] * [[:wiki:forensic_checklists:malware_triage_checklist|Malware Triage Checklist]] * [[:wiki:forensic_checklists:memory_acquisition_checklist|Memory Acquisition Checklist]] * [[:wiki:forensic_checklists:mobile_evidence_checklist|Mobile Evidence Checklist]] * [[:wiki:forensic_checklists:cloud_evidence_checklist|Cloud Evidence Checklist]] * [[:wiki:forensic_checklists:legal_handoff_checklist|Legal Handoff Checklist]] ===== Tools and Resources ===== * [[:wiki:tools:start|Tools]] * [[:wiki:resources:start|Resources]] * [[:wiki:support|Support]] Tools parse evidence. They do not create conclusions. A parser can surface an artifact; it cannot stop a bad interpretation from putting on a suit and walking into a report. ===== Defensive Use Only ===== This wiki discusses anti-forensics from a defensive, investigative, and educational perspective. It is intended to help readers: * recognize suspicious or misleading evidence patterns * understand recovery and storage limits * avoid overclaiming user intent * write cleaner forensic reports * compare artifacts responsibly * understand what tools can and cannot prove * distinguish technical limits from hostile behavior Do not use this material to destroy, conceal, alter, or tamper with evidence. That is not advanced tradecraft. That is leaving fingerprints on the shovel. ===== Reader Takeaway ===== Anti-forensics is not only about wiping files or hiding traces. In real forensic work, the harder problem is interpretation. A missing file may matter. A suspicious timestamp may matter. A cleanup tool may matter. But evidence does not become stronger because the paragraph sounds confident. The clean analyst asks: * What was actually observed? * What else could explain it? * What independent evidence supports it? * What cannot be proven from this artifact alone? * How should this be written so it survives review? That is where forensic work becomes useful. Everything else is just unallocated space looking dramatic. ===== Use Notes ===== This wiki is for defensive education and technical reference. It should not be treated as legal, forensic, investigative, compliance, or operational advice without qualified professional judgment. Anti-Forensics.com does not provide instructions for evidence destruction, concealment, tampering, evasion, or misuse. The focus is artifact interpretation, defensive detection, recovery limits, and responsible reporting.