Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and re- active measures. Diverse and realistic datasets that reflect anti-forensic measures are needed to validate digital forensic tools and advance digi- tal forensics education and research. However, datasets are increasingly created in a synthetic manner due to privacy and legal constraints. The work described in this chapter contributes to improving the dig- ital forensic process by assessing anti-forensic measures at the filesys- tem level and providing a means for synthesizing datasets containing anti-forensic artifacts. Specifically, it provides an in-depth analysis of anti-forensic data hiding techniques in the evolving Linux-based B-tree filesystem (Btrfs). Also, it presents a methodology for generating anti- forensic traces at the filesystem level in a post mortem storage device dataset. The methodology links the ForTrace data synthesis framework and fishy anti-forensic data hiding framework. A data synthesis tool is developed for generating anti-forensic data hiding traces for three com- mon filesystems, NTFS, ext4 and Btrfs, and providing essential data synthesis functionality to simulate the expected behavior of the opera- ting system. Additionally, a validation model comprising three complex- ity levels is presented for assessing the implemented anti-forensic data hiding techniques. Overall, the research provides a powerful approach for generating datasets that reflect anti-forensic artifacts potentially used by attackers.    «

Digital forensics and anti-forensics are essential to security because they provide vital information to institute preventive and re- active measures. Diverse and realistic datasets that reflect anti-forensic measures are needed to validate digital forensic tools and advance digi- tal forensics education and research. However, datasets are increasingly created in a synthetic manner due to privacy and legal constraints. The work described in this chapter contributes to improving the dig- ital f...    »