Systematic Review: Anti-Forensic Computer Techniques
Source abstract
Abstract
The main purpose of anti-forensic computer techniques, in the broadest sense, is to hinder the investigation of a computer attack by eliminating traces and preventing the collection of data contained in a computer system. Nowadays, cyber-attacks are becoming more and more frequent and sophisticated, so it is necessary to understand the techniques used by hackers to be able to carry out a correct forensic analysis leading to the identification of the perpetrators. Despite its importance, this is a poorly represented area in the scientific literature. The disparity of the existing works, together with the small number of articles, makes it challenging to find one’s way around the vast world of computer forensics. This article presents a comprehensive review of the existing scientific literature on anti-forensic techniques, mainly DFIR (digital forensics incident response), organizing the studies according to their subject matter and orientation. It also presents key ideas that contribute to the understanding of this field of forensic science and details the shortcomings identified after reviewing the state of the art.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Digital and Cyber Forensics · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Escuela Superior de Ingeniería y Tecnología, Universidad Internacional de La Rioja, Avenida de La Paz, 137, 26006 La Rioja, Spain
References (100+)
Show source-provided references
1. Peron, C.S.J., and Legary, M. (2005, January 28–30). Digital anti-forensics: Emerging trends in data transformation techniques. Proceedings of the E-Crime and Computer Evidence Conference, Montecarlo, Monaco.
2. Computer anti-forensics methods and their impact on computer forensic investigation
3. Freiling. A universal taxonomy and survey of forensic memory acquisition techniques10.1016/j.diin.2019.01.001 ↗
4. Hiding Process Memory Via Anti-Forensic Techniques
5. Kitchenham, B., and Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering Version 2.3, University of Durham. Technical Report.
6. Systematic literature reviews in software engineering—A systematic literature review10.1016/j.infsof.2008.09.009 ↗
7. A Systematic Review of Systematic Review Process Research in Software Engineering10.1016/j.infsof.2013.07.010 ↗
8. Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy10.1016/j.diin.2016.04.006 ↗
9. Rogers, M. (2024, June 10). Anti-Forensics: The Coming Wave in Digital Forensics. Available online: https://www.cerias.purdue.edu/news_and_events/events/symposium/2006/materials/pdfs/antiforensics.pdf.
10. Hassan, N.A., and Hijazi, R. (2017). Antiforensic Techniques. Data Hiding Techniques in Windows OS, Syngress.10.1016/B978-0-12-804449-0.00007-5 ↗
11. Anti-forensic threat modelling
12. Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem10.1016/j.diin.2006.06.005 ↗
13. A hierarchical, objectives-based framework for the digital investigations process10.1016/j.diin.2005.04.002 ↗
14. Forensic artefacts associated with intentionally deleted user accounts10.1504/IJESDF.2017.083992 ↗
15. Gül, M., and Kugu, E. (2017, January 16–17). A survey on anti-forensics techniques. Proceedings of the 2017 International Artificial Intelligence and Data Processing Symposium (IDAP), Malatya, Turkey.10.1109/IDAP.2017.8090341 ↗
16. Mothukur, A.R., Balla, A., Taylor, D.H., Sirimalla, S.T., and Elleithy, K. (2019, January 3). Investigation of Countermeasures to Anti-Forensic Methods. Proceedings of the 2019 IEEE Long Island Systems, Applications and Technology Conference (LISAT), Farmingdale, NY, USA.10.1109/LISAT.2019.8816826 ↗
17. File system anti-forensics–types, techniques and tools10.1016/S1361-3723(20)30030-0 ↗
18. Jang, D.-I., Ahn, G.-J., Hwang, H., and Kim, K. (2016, January 28–30). Understanding anti-forensic techniques with timestamp manipulation. Proceedings of the 2016 IEEE 17th International Conference on Information Reuse and Integration, IRI, Pittsburgh, PA, USA.10.1109/IRI.2016.94 ↗
19. An emerging threat Fileless malware: A survey and research challenges10.1186/s42400-019-0043-x ↗
20. Identification of Various Image Operations Using Residual-Based Features10.1109/TCSVT.2016.2599849 ↗
21. Bibliography of digital image anti-forensics and anti-anti-forensics techniques10.1049/iet-ipr.2018.6587 ↗
22. A multi-purpose image counter-anti-forensic method using convolutional neural networks10.1007/978-3-319-53465-7_1 ↗
23. Stamm, M.C., and Zhao, X. (2022). Anti-Forensic Attacks Using Generative Adversarial Networks. Multimedia Forensics. Advances in Computer Vision and Pattern Recognition, Springer.10.1007/978-981-16-7621-5_17 ↗
24. Attacking contrast enhancement forensics in digital images
25. ACE-An effective anti-forensic contrast enhancement technique10.1109/LSP.2015.2509477 ↗
26. Anti-Forensics Contrast Enhancement Detection (AFCED) Technique in Images Based on Laplace Derivative Histogram10.1007/s11036-019-01255-1 ↗
27. Alternative anti-forensics method for contrast enhancement10.1007/978-3-642-32205-1_32 ↗
28. Lin, X., Li, C.-T., and Hu, Y. (2013, January 15–18). Exposing image forgery through the detection of contrast enhancement. Proceedings of the 2013 IEEE International Conference on Image Processing, ICIP 2013, Melbourne, VIC, Australia.10.1109/ICIP.2013.6738920 ↗
29. Anti-forensics of image contrast enhancement based on generative adversarial network
30. A novel contrast enhancement forensics based on convolutional neural networks10.1016/j.image.2018.02.001 ↗
31. Contrast Enhancement Forensics Based on Modified Convolutional Neural Network
32. On the security of image manipulation forensics10.1007/978-3-319-24075-6_10 ↗
33. Fontani, M., Bonchi, A., Piva, A., and Barni, M. (2014, January 2–6). Countering anti-forensics using data fusion. Proceedings of the SPIE—The International Society for Optical Engineering, San Francisco, CA, USA.10.1117/12.2039569 ↗
34. Robustness of color interpolation identification against anti-forensic operations10.1007/978-3-642-36373-3_2 ↗
35. Anti-forensics for unsharp masking sharpening in digital images10.4018/jdcf.2013070104 ↗
36. Anti-forensics of Image Sharpening Using Generative Adversarial Network10.1007/978-3-030-43575-2_12 ↗
37. Digital video tampering detection: An overview of passive techniques10.1016/j.diin.2016.06.003 ↗
38. A comprehensive survey on passive techniques for digital video forgery detection10.1007/s11042-020-09974-4 ↗
39. Bestagini, P., Battaglia, S., Milani, S., Tagliasacchi, M., and Tubaro, S. (2013, January 26–31). Detection of temporal interpolation in video sequences. Proceedings of the 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, Vancouver, BC, Canada.10.1109/ICASSP.2013.6638215 ↗
40. Stamm, M.C., Lin, W.S., and Liu, K.J.R. (2012, January 25–30). Forensics vs. anti-forensics: A decision and game theoretic framework. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Kyoto, Japan.10.1109/ICASSP.2012.6288237 ↗
41. Forensic and anti-forensic techniques for video shot editing in H.264/AVC10.1016/j.jvcir.2015.02.006 ↗
42. Forensics and counter anti-forensics of video inter-frame forgery10.1007/s11042-015-2762-7 ↗
43. Milani, S., Bestagini, P., Tagliasacchi, M., and Tubaro, S. (2014, January 4–9). Antiforensic synthesis of motion vectors using template algorithms. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Florence, Italy.10.1109/ICASSP.2014.6854092 ↗
44. Chen, C., Zhao, X., and Stamm, M.C. (2017, January 17–20). Detecting anti-forensic attacks on demosaicing-based camera model identification. Proceedings of the International Conference on Image Processing, ICIP, Beijing, China.10.1109/ICIP.2017.8296534 ↗
45. Chen, C., Zhao, X., and Stamm, M.C. (2018, January 7–10). Mislgan: An Anti-Forensic Camera Model Falsification Framework Using a Generative Adversarial Network. Proceedings of the International Conference on Image Processing, ICIP, Athens, Greece.10.1109/ICIP.2018.8451503 ↗
46. An approach to detect video frame deletion under anti-forensics10.1007/s11554-019-00865-y ↗
47. Anti-Forensics for Face Swapping Videos via Adversarial Training10.1109/TMM.2021.3098422 ↗
48. A Local Perturbation Generation Method for GAN-generated Face Anti-forensics10.1109/TCSVT.2022.3207310 ↗
49. BDC-GAN: Bidirectional Conversion Between Computer-Generated and Natural Facial Images for Anti-Forensics10.1109/TCSVT.2022.3177238 ↗
50. Fan, L., Li, W., and Cui, X. (2021). Deepfake-image anti-forensics with adversarial examples attacks. Future Internet, 13.10.3390/fi13110288 ↗
51. Perception matters: Exploring imperceptible and transferable anti-forensics for GAN-generated fake face imagery detection10.1016/j.patrec.2021.03.009 ↗
52. Zhao, X., and Stamm, M.C. (2022). Making Generated Images Hard to Spot: A Transferable Attack on Synthetic Image Detectors. Pattern Recognition, Computer Vision, and Image Processing, Springer. Lecture Notes in Computer Science.
53. Ngoc, N.H., Chan, A., Binh, H.T.T., and Ong, Y.S. (2022, January 18–23). Anti-Forensic Deepfake Personas and How To Spot Them. Proceedings of the International Joint Conference on Neural Networks, Padua, Italy.10.1109/IJCNN55064.2022.9892357 ↗
54. CGR-GAN: CG Facial Image Regeneration for Antiforensics Based on Generative Adversarial Network10.1109/TMM.2019.2959443 ↗
55. An approach to detecting JPEG down-recompression and seam carving forgery under recompression anti-forensics10.1016/j.patcog.2016.12.010 ↗
56. Luo, Y., Zi, H., Zhang, Q., and Kang, X. (2018, January 3–7). Anti-forensics of JPEG compression using generative adversarial networks. Proceedings of the European Signal Processing Conference, Rome, Italy.10.23919/EUSIPCO.2018.8553259 ↗
57. A JPEG blocking artefact detector for image forensics10.1016/j.image.2018.07.011 ↗
58. Robust median filtering detection based on filtered residual10.1007/978-3-642-40099-5_29 ↗
59. Anti-forensics of median filtering and contrast enhancement10.1016/j.jvcir.2019.102682 ↗
60. Kang, X., Qin, T., and Zeng, H. (2015, January 12–15). Countering median filtering anti-forensics and performance evaluation of forensics against intentional attacks. Proceedings of the 2015 IEEE China Summit and International Conference on Signal and Information Processing, ChinaSIP 2015, Chengdu, China.10.1109/ChinaSIP.2015.7230449 ↗
61. Cao, G., Zhao, Y., Ni, R., and Tian, H. (2010, January 9–10). Anti-forensics of contrast enhancement in digital images. Proceedings of the MM and Sec’10, 2010 ACM SIGMM Multimedia and Security Workshop, Rome, Italy.10.1145/1854229.1854237 ↗
62. Wu, Z.-H., Stamm, M.C., and Liu, K.J.R. (2013, January 26–31). Anti-forensics of median filtering. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Vancouver, BC, Canada.10.1109/ICASSP.2013.6638217 ↗
63. Median filtering forensics based on multi-directional difference of filtering residuals
64. An improved median filtering anti-forensics with better image quality and forensic undetectability10.1007/s11045-019-00637-8 ↗
65. Sharma, S., Subramanyam, A.V., Jain, M., Mehrish, A., and Emmanuel, S. (2016, January 4–7). Anti-forensic technique for median filtering using L1-L2 TV model. Proceedings of the 8th IEEE International Workshop on Information Forensics and Security, WIFS, Abu Dhabi, United Arab Emirates.10.1109/WIFS.2016.7823571 ↗
66. Zeng, H., Qin, T., Kang, X., and Liu, L. (2014, January 4–9). Countering anti-forensics of median filtering. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Florence, Italy.10.1109/ICASSP.2014.6854091 ↗
67. Median filtered image quality enhancement and anti-forensics via variational deconvolution10.1109/TIFS.2015.2398362 ↗
68. Fontani, M., and Barni, M. (2012, January 27–31). Hiding Traces of Median Filtering in Digital Images. Proceedings of the European Signal Processing Conference, Bucharest, Romania. Available online: https://www.scopus.com/inward/record.uri?eid=2-s2.0-84869807478&partnerID=40&md5=53ba0ecb13a67b9540393515ca0b3f90.
69. Waleed, J., Hasan, T.M., and Abbas, T. (2017, January 7–9). Comprehensive expansion in Anti-Forensics Techniques (AFTs) based compressed image. Proceedings of the 2017 Annual Conference on New Trends in Information and Communications Technology Applications, NTICT, Baghdad, Iraq.10.1109/NTICT.2017.7976108 ↗
70. Yang, H., and Zhou, Z. (2014, January 7–9). Hiding the Trace of JPEG compression history. Proceedings of the 2014 4th International Conference on Communication Systems and Network Technologies, CSNT, Bhopal, India.10.1109/CSNT.2014.187 ↗
71. Afshin, N., Razzazi, F., and Moin, M.-S. (2016, January 4–6). A dictionary based approach to JPEG anti-forensics. Proceedings of the 2016 IEEE 8th International Conference on Intelligent Systems, IS 2016, Sofia, Bulgaria.10.1109/IS.2016.7737401 ↗
72. Feng, C., Xu, Z., and Zheng, X. (2012, January 14–16). An anti-forensic algorithm of JPEG double compression based forgery detection. Proceedings of the 2012 4th International Symposium on Information Science and Engineering, ISISE, Shanghai, China.
73. Sheng, G., and Su, Q. (2014, January 8–10). Erasing the JPEG compression artefacts: An improved counter-forensic algorithm based on parameter adjustment. Proceedings of the 2014 9th International Conference on Broadband and Wireless Computing, Communication and Applications, BWCCA, Guangdong, China.10.1109/BWCCA.2014.83 ↗
74. Singh, A.K., Rawat, C.S., and Bhatia, A. (2017, January 1–2). Alleviation of quantization artefact using anti-forensic in image processing. Proceedings of the 2017 International Conference on Energy, Communication, Data Analytics and Soft Computing, ICECDS, Chennai, India.10.1109/ICECDS.2017.8389944 ↗
75. Counter JPEG anti-forensic approach based on the second-order statistical analysis10.1109/TIFS.2018.2871751 ↗
76. Stamm, M.C., Tjoa, S.K., Lin, W.S., and Liu, K.J.R. (2010, January 14–19). Anti-forensics of JPEG compression. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Dallas, TX, USA.10.1109/ICASSP.2010.5495491 ↗
77. Valenzise, G., Nobile, V., Tagliasacchi, M., and Tubaro, S. (2011, January 11–14). Countering JPEG anti-forensics. Proceedings of the International Conference on Image Processing, ICIP, Brussels, Belgium.10.1109/ICIP.2011.6115854 ↗
78. Kaimal, A.B., Manimurugan, S., Rajivkumar, J. (2013, January 4–5). A new technique for removing forensically detectable traces from digital images. Proceedings of the 7th International Conference on Intelligent Systems and Control, ISCO, Coimbatore, India.10.1109/ISCO.2013.6481171 ↗
79. JPEG anti-forensics with an improved tradeoff between forensic undetectability and image quality10.1109/TIFS.2014.2317949 ↗
80. Chu, X., Stamm, M.C., Chen, Y., and Liu, K.J.R. (2013, January 26–31). Concealability-rate-distortion tradeoff in image compression anti-forensics. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Vancouver, BC, Canada.10.1109/ICASSP.2013.6638221 ↗
81. An approach to expose dithering-based JPEG anti-forensics10.1016/j.forsciint.2021.111040 ↗
82. Improved anti-forensics of JPEG compression10.1016/j.jss.2013.12.043 ↗
83. Anti-forensics of double JPEG compression detection10.1007/978-3-642-32205-1_33 ↗
84. On antiforensic concealability with rate-distortion tradeoff10.1109/TIP.2015.2390137 ↗
85. Jiang, Y., Zeng, H., Kang, X., and Liu, L. (November, January 29). The game of countering JPEG anti-forensics based on the noise level estimation. Proceedings of the 2013 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference, APSIPA 2013, Kaohsiung, Taiwan.10.1109/APSIPA.2013.6694156 ↗
86. An improved anti-forensics JPEG compression using Least Cuckoo Search algorithm10.1080/13682199.2017.1389832 ↗
87. Digital image forensic approach to counter the JPEG anti-forensic attacks10.1109/ACCESS.2020.3048246 ↗
88. Improved JPEG anti-forensics with better image visual quality and forensic undetectability10.1016/j.forsciint.2017.06.003 ↗
89. Stamm, M.C., Tjoa, S.K., Lin, W.S., and Liu, K.J.R. (2010, January 26–29). Undetectable image tampering through JPEG compression anti-forensics. Proceedings of the International Conference on Image Processing, ICIP, Hong Kong, China.10.1109/ICIP.2010.5652553 ↗
90. Fahmy, G. (2012, January 18). Detectable Tampering of JPEG Anti-Forensics. Proceedings of the WIAR 2012—National Workshop on Information Assurance Research, Riyadh, Saudi Arabia. Available online: https://www.scopus.com/inward/record.uri?eid=2-s2.0-84929257836&partnerID=40&md5=d92e5c5870e0554b15f2f635e6cc943c.
91. Fahmy, G., and Wurtz, R. (2016, January 12–14). Phase based forgery detection of JPEG anti forensics. Proceedings of the 2016 IEEE International Symposium on Signal Processing and Information Technology, ISSPIT, Limassol, Cyprus.10.1109/ISSPIT.2016.7886024 ↗
92. Anti-Forensics of Lossy Predictive Image Compression10.1109/LSP.2015.2472561 ↗
93. Simplified anti-forensics of JPEG compression10.4304/jcp.8.10.2483-2488 ↗
94. An improved anti-forensic technique for JPEG compression10.1007/s11042-019-7734-x ↗
95. Fan, W., Wang, K., Cayre, F., and Xiong, Z. (2013, January 26–31). A variational approach to JPEG anti-forensics. Proceedings of the ICASSP, IEEE International Conference on Acoustics, Speech and Signal Processing, Vancouver, BC, Canada.10.1109/ICASSP.2013.6638220 ↗
96. Bhatia, A., Rawat, C.D., and Kumarjetawat, A. (2017, January 21–22). Digital artifacts-anti-forensics approach for optimization of digital images. Proceedings of the IEEE International Conference on Power, Control, Signals and Instrumentation Engineering, ICPCSI, Chennai, India.10.1109/ICPCSI.2017.8391771 ↗
97. Fan, W., Wang, K., Cayre, F., and Xiong, Z. (2013, January 17–19). JPEG anti-forensics using non-parametric DCT quantization noise estimation and natural image statistics. Proceedings of the IH and MMSec 2013, 2013 ACM Information Hiding and Multimedia Security Workshop, Montpellier, France.10.1145/2482513.2482536 ↗
98. A method for detecting JPEG anti-forensics
99. A new anti-forensic scheme-hiding the single JPEG compression trace for a digital image10.1111/1556-4029.12618 ↗
100. Anti-forensics of JPEG compression detection schemes using an approximation of DCT coefficients10.1007/s11042-018-6170-7 ↗