Anti-Forensic Threat Modeling

Abstract

The role of a digital forensic professional is to collect and analyze digital evidence. However, anti-forensic techniques can reduce the availability or usefulness of the evidence. They threaten the digital forensic examination process and may compromise its conclusions. This chapter proposes the use of threat modeling to manage the risks associated with anti-forensic threats. Risk management is introduced in the early stages of the digital forensic process to assist a digital forensic professional in determining the resources to be invested in detecting and mitigating the risk. The proposed threat model complements the incident response and digital forensic processes by providing a means for assessing the impact and likelihood of anti-forensic threats, evaluating the cost of risk mitigation and selecting tools and techniques that can be used as countermeasures. This renders the digital forensic process more robust and less susceptible to the consequences of anti-forensic actions.

Systematic Review: Anti-Forensic Computer Techniques

“…The contribution of the articles by B. Hoelz et al [11] and A.R. Mothukur et al [16] are recent developments that had not been addressed or had hardly been outlined previously.…”

“…New threat models and forecasts 8 [11,12,[221][222][223][224][225][226] B. Hoelz et al [11] propose a threat model to manage the risks associated with antiforensic threats. J. Nikolai et al [221] present a framework within which to examine the risks associated with the human facet.…”

“…The use of threat models [11] to manage anti-forensic risks, the understanding of the motivations behind the use of anti-forensic tools [221], the development of effective countermeasures [12,222,225], and the establishment of standards for secure data erasure [224] are essential elements in ensuring the integrity of digital evidence in forensic investigations.…”

“…B. Hoelz et al [11] bring a new vision to the field of anti-forensic techniques, proposing a threat and risk management model to mitigate the negative impact they cause during a forensic analysis. Their study used the classification model presented by R. Harris [12], which organizes the actions executed by an attacker into four groups: Based on these considerations, they present the threat model shown in Figure 6.…”