Analyzing Anti-Forensics Techniques

Official references for this objective

• Sans — SANS Digital Forensics and Incident Response Blog | Digital Forensics: Detecting time stamp manipulation | SANS Institute

  Windows does not typically update this set of temporal values like it does with those in the "$STANDARD_INFORMATION" attribute, and they frequently correspond to when

• Sans — Breaking Time: Methods, Artifacts, and Forensic Detection of Timestomping on FAT32, Ext3, and Ext4 File Systems | SANS Institute

  focusing on how adversaries adapt their approaches based on available system access and permissions