Analyzing Anti-Forensics Techniques — GIAC Linux Incident Responder

The official GIAC documentation our Analyzing Anti-Forensics Techniques practice questions are cited to. Review the primary sources, then practise.

Official references for this objective

Sans — SANS Digital Forensics and Incident Response Blog | Digital Forensics: Detecting time stamp manipulation | SANS Institute

Windows does not typically update this set of temporal values like it does with those in the "$STANDARD_INFORMATION" attribute, and they frequently correspond to when
Sans — Breaking Time: Methods, Artifacts, and Forensic Detection of Timestomping on FAT32, Ext3, and Ext4 File Systems | SANS Institute

focusing on how adversaries adapt their approaches based on available system access and permissions