Tampering with Truth: Designing a Tool to Undermine Digital Evidence Recovery

The internet and technology advancements have given rise to too much comfort for both legitimate and malicious users or cyber criminals. Therefore, if these advancements are misused deliberately by the offenders, it can result in many harmful consequences, such as the prevention of services for benign or legitimate users. It is very difficult to investigate and prosecute any electronic crime because investigators need to build their cases or perform the investigation according to the evidence left by the computer criminals on the system. These days, computer criminals or adversaries are very much aware of the Computer Anti-forensic tactics and methods. Criminals apply such anti-forensic techniques to impede the whole digital investigation process efficiently and successfully. Such forensic investigation processes affected by Anti-forensic measures are too expensive and time-consuming to carry out. Numerous anti-forensic techniques can be used by anti-forensic practitioners to thwart the investigation process. Therefore, intruders try to hide or wipe out the evidence from the compromised system so that they cannot fall into the hands of Forensic examiners. Adversaries can try their very best to protect their evidence so that they can use any anti-forensic techniques for the same.

In this study, we have proposed an Anti-Forensic tool for destructing the evidential files stored on the hard disk. Our proposed tool works under the controlled environment of the Secondary extended file system of the Linux distribution. This tool clears out all the inodes which actually store the metadata of the files and folders on the file system, so clearing the inodes corrupts the file system structure in the internal structure of the file system. Detection of such activity performed by the anti-forensic practitioner is possible by the Forensics software or Forensic Investigator during the Investigation. Still, it will not be possible for the analyst to recover the file content as the file will no longer be accessible, as its inode entries have already been cleared out by the intruder. In this research work, we have also compared our proposed tool with similar existing tools and found that none other than the proposed one could clear out all the inode entries of the evidential files on the File System.