What is 'anti-forensics' and give two common techniques used to hinder forensic analysis?

• A. Anti-forensics are techniques to impede evidence collection; examples include log tampering and data obfuscation/encryption or secure deletion
• B. Anti-forensics are techniques to improve evidence collection
• C. Anti-forensics involve routine system hardening
• D. Anti-forensics are methods to speed up data recovery after incidents

Answer: (A)

Anti-forensics are techniques designed to hinder forensic investigators by obstructing evidence collection and analysis. This often means actions taken to conceal, corrupt, or erase artifacts that would normally be used to reconstruct what happened. Two common techniques used to impede forensic analysis are tampering with logs to hide a clear activity timeline and securely deleting data to remove traces of maneuvers or exfiltration. Data obfuscation or encryption of cached or stored data is another frequent tactic, making it harder for analysts to interpret content and draw accurate conclusions. These approaches slow down investigation, mislead analysis, or erase critical evidence, which is the aim of anti-forensics.