Data Wiping Tool: ByteEditor Technique

Riduan, Nuraqilah Haidah Ahmad; Foozy, Cik Feresa Mohd; Hamid, Isredza Rahmi A.; Shamala, Palaniappan; Othman, Nur Fadzilah

doi:10.1109/crc50527.2021.9392502

Cited by 1 publication

(1 citation statement)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are four types of anti‐forensic techniques, including artifact wiping, data hiding, trail obfuscation, and attacks against forensic technology [2, 3]. Among them, artifact wiping, particularly file‐wiping, can have a significant impact on forensic investigations as it overwrites the source of evidence with zeroes, known patterns, or random data [4, 5]. As it can erase evidence permanently, hinder investigations, and increase analysis time [6], determining whether the file‐wiping tool has been executed is crucial in digital forensics, which requires the rapid extraction of information from evidence.…”

Section: Introductionmentioning

confidence: 99%

A reference database of Windows artifacts for file‐wiping tool execution analysis

Joo

Lee

Jeong

2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

Anti‐forensic technology can play an effective role in protecting information, but it can make forensic investigations difficult. Specifically, file‐wiping permanently erases evidence, making it challenging for investigators to determine whether a file ever existed and prolonging the investigation process. To address this issue, forensic researchers have studied anti‐forensic techniques that detect file‐wiping activities. Many previous studies have focused on the effects of file‐wiping tools on $MFT, $LogFile, and $DATA, rather than on Windows artifacts. Additionally, previous studies that have examined Windows artifacts have considered different artifacts, making it difficult to study them in a comprehensive manner. To address this, we focused on analyzing traces in 13 Windows artifacts of 10 file‐wiping tools' operations in the Windows operating system comprehensively. For our experiments, we installed each file‐wiping tool on separate virtual machines and checked the traces that the tools left behind in each artifact. We then organized the results in a database format. Our analysis revealed that most of the tools left traces on other artifacts, except for JumpList, Open&SavePidlMRU, and lnk. There were also some cases where traces remained on the other three artifacts. Based on our research, forensic investigators can quickly identify whether a file‐wiping tool has been used, and it can assist in decision‐making for evidence collection and forensic triage.

show abstract