The term computer anti-forensics (CAF) generally refers to a set of tactical and technical measures intended to circumvent the efforts and objectives of the field of computer and network forensics (CF). Many scientific techniques, procedures, and technological tools have evolved and effectively applied in the field of CF to assist scientists and investigators in acquiring and analyzing digital evidence for the purpose of solving cases that involve the use or misuse of computer systems. CAF has emerged as a CF counterpart that plants obstacles throughout the path of computer investigations. The purpose of this paper is to highlight the challenges introduced by anti-forensics, explore various CAF mechanisms, tools, and techniques, provide a coherent classification for them, and discuss their effectiveness. Moreover, the authors discuss the challenges in implementing effective countermeasures against these techniques. A set of recommendations are presented with future research opportunities.<\/p>","DOI":"10.4018\/ijcac.2011070103","type":"journal-article","created":{"date-parts":[[2011,10,19]],"date-time":"2011-10-19T16:07:30Z","timestamp":1319040450000},"page":"22-35","source":"Crossref","is-referenced-by-count":1,"title":["Toward Understanding the Challenges and Countermeasures in Computer Anti-Forensics"],"prefix":"10.4018","volume":"1","author":[{"given":"Kamal","family":"Dahbur","sequence":"first","affiliation":[{"name":"New York Institute of Technology, Jordan"}]},{"given":"Bassil","family":"Mohammad","sequence":"additional","affiliation":[{"name":"New York Institute of Technology, Jordan"}]}],"member":"2432","reference":[{"issue":"1","key":"ijcac.2011070103-0","article-title":"Cloud computing storms.","volume":"1","author":"S.Biggs","year":"2010","journal-title":"International Journal of Intelligent Computing Research"},{"key":"ijcac.2011070103-1","author":"M.Brand","year":"2007","journal-title":"Forensics analysis avoidance techniques of malware"},{"key":"ijcac.2011070103-2","unstructured":"Findlaw.com. (n. d.). U.S. vs. Robert Johnson - Child pornography indictment. Retrieved from http:\/\/news.findlaw.com\/hdocs\/docs\/chldprn\/usjhnsn62805ind.pdf"},{"key":"ijcac.2011070103-3","unstructured":"Garfinkel, S. (2007). Anti-forensics: Techniques, detection and countermeasures. In Proceedings of the 2nd International Conference in i-Warefare and Security (p. 77)."},{"key":"ijcac.2011070103-4","unstructured":"Geiger, M. (2005). Evaluating commercial counter-forensic tools. Paper presented at the Digital Forensic Research Workshop, Pittsburgh, PA."},{"key":"ijcac.2011070103-5","unstructured":"Guidance Software. (n. d.). Computer forensics solutions and digital investigations. Retrieved from http:\/\/www.guidancesoftware.com\/"},{"key":"ijcac.2011070103-6","doi-asserted-by":"crossref","unstructured":"Gurav, U., & Shaikh, R. (2010). Virtualization \u2013 A key feature of cloud computing. In Proceedings of the International Conference and Workshop on Emerging Trends in Technology (pp. 227-229).","DOI":"10.1145\/1741906.1741957"},{"key":"ijcac.2011070103-7","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.005"},{"key":"ijcac.2011070103-8","author":"M. W.Hartley","year":"2007","journal-title":"Current and future threats to digital forensics"},{"key":"ijcac.2011070103-9","unstructured":"Internet World Stats. (n. d.). The Internet big picture, world Internet users and population stats. Retrieved from http:\/\/www.internetworldstats.com\/stats.htm"},{"key":"ijcac.2011070103-10","unstructured":"Justice.gov. (2003). United States of America vs. H. Marc Watzman. Retrieved from http:\/\/www.justice.gov\/usao\/iln\/indict\/2003\/watzman.pdf"},{"key":"ijcac.2011070103-11","unstructured":"Kessler, G. (2011). File signature table. Retrieved from http:\/\/www.garykessler.net\/library\/file_sigs.html"},{"key":"ijcac.2011070103-12","author":"G. C.Kessler","year":"2007","journal-title":"Anti-forensics and the digital investigator"},{"key":"ijcac.2011070103-13","unstructured":"McLeod, S. (2005). SMART anti-forensics. Retrieved from http:\/\/www.forensicfocus.com\/smart-anti-forensics"},{"key":"ijcac.2011070103-14","unstructured":"Mitre.org. (2011). Common vulnerabilities and exposures (CVE) database. Retrieved from http:\/\/cve.mitre.org\/"},{"key":"ijcac.2011070103-15","author":"B.Nelson","year":"2010","journal-title":"Guide to computer forensics and investigations"},{"key":"ijcac.2011070103-16","unstructured":"Newsham, T., Palmer, C., & Stamos, A. (2007). Breaking forensics software: Weaknesses in critical evidence collection. Retrieved from http:\/\/www.isecpartners.com"},{"key":"ijcac.2011070103-17","unstructured":"Secureworks.com. (2008). Security 101: Botnets. Retrieved from http:\/\/www.secureworks.com\/research\/newsletter\/2008\/05\/"},{"key":"ijcac.2011070103-18","author":"S.Srinivasan","year":"2007","journal-title":"Security and privacy vs. computer forensics capabilities"},{"key":"ijcac.2011070103-19","unstructured":"Thuen, C. (2007). Understanding counter-forensics to ensure a successful investigation. Retrieved from http:\/\/citeseerx.ist.psu.edu\/viewdoc\/summary?doi=10.1.1.138.2196"},{"key":"ijcac.2011070103-20","unstructured":"Trickyways.com. (2009). How to change timestamp of a file in Windows. Retrieved from http:\/\/www.trickyways.com\/2009\/08\/how-to-change-timestamp-of-a-file-in-windows-file-created-modified-and-accessed\/"},{"key":"ijcac.2011070103-21","unstructured":"US-Computer Emergency Readiness Team. C. (2008). Computer F=Forensics. Retrieved from http:\/\/www.us-cert.gov\/reading_room\/forensics.pdf"},{"key":"ijcac.2011070103-22","unstructured":"Verizon Business. (2009). 2009 data breach investigations report. Retrieved from http:\/\/www.verizonbusiness.com\/about\/news\/podcasts\/1008a1a3-111=129947--Verizon+Business+2009+Data+Breach+Investigations+Report.xml"},{"key":"ijcac.2011070103-23","unstructured":"Verizon Business. (2010). 2010 data breach investigations report. Retrieved from http:\/\/www.verizonbusiness.com\/resources\/reports\/rp_2010-data-breach-report_en_xg.pdf?&src=\/worldwide\/resources\/index.xml&id="},{"key":"ijcac.2011070103-24","doi-asserted-by":"crossref","unstructured":"Wang, X., & Yu, H. (2005). How to break MD5 and other hash functions. In Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 19-35).","DOI":"10.1007\/11426639_2"},{"key":"ijcac.2011070103-25","unstructured":"Whitteker, M. (2008, 11). Anti-forensics: Breaking the forensics process. ISSA Journal."}],"container-title":["International Journal of Cloud Applications and Computing"],"original-title":[],"language":"ng","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=58059","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T22:00:15Z","timestamp":1654120815000},"score":1,"resource":{"primary":{"URL":"https:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/ijcac.2011070103"}},"subtitle":[""],"short-title":[],"issued":{"date-parts":[[2011,7,1]]},"references-count":26,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2011,7]]}},"URL":"https:\/\/doi.org\/10.4018\/ijcac.2011070103","relation":{},"ISSN":["2156-1834","2156-1826"],"issn-type":[{"value":"2156-1834","type":"print"},{"value":"2156-1826","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,7,1]]}}}