Recognizing Anti-Forensic Tools in Litigation

Many cases involve the review of computers to search for documents, email, chat, or other records. This data can tell the story of what the parties were doing, when, and often why. In the age of smartphones, it is no surprise that digital records have become so important in proving our cases. This is why it is such a surprise when you examine any device that was used over a long period of time that has no records of interest: empty or missing email, no chat or text messages, no internet history, no pictures or videos.

In some cases, the original device does not have any useful data; it is the second phone or laptop with the relevant data. It is very common to have personal or business emails, pictures, videos, chat or documents or other data on our phones and computers. There are times when a user realizes that the phone or computer contains information that could be damaging to them. This could be after they realize there will be a lawsuit, or in many cases it is after a preservation order has been served. The next thought is often, “Is there anything left that could be helpful?” and “Is there any way to prove that data was intentionally deleted?”

Defining Anti-Forensics

Applications used to delete and remove data from computers are often referred to as “anti-forensics” tools. These tools are inexpensive or even free. These applications deploy different methods to remove data. As you would expect, you get what you pay for in this area and some tools are not as successful as others in their mission to remove data. Many tools do very simple processes that don’t affect many system files or logs that keep track of user activity. Some anti-forensics tools create logs of the files they delete – often giving clear evidence of when the tool was used and what was done.

There are ways to determine if certain anti-forensics tools were used. Highly trained forensic examiners know where to look for data that is not deleted or wiped by these anti-forensics tools. Properly trained and experienced forensic examiners can often recover deleted documents, find log files of anti-forensics processes, locate and interpret system files to show what files were deleted and when. Advanced techniques can be used to find and recover deleted copies of data and files. In many cases, hundreds of deleted files and thousands of Internet history records, or email going back many years, have been recovered and used as evidence in court.

Forensically Triage the Data

Skilled forensic examiners know how to perform a triage on evidence items – knowing how to look for signs that data has not been permanently deleted and overwritten. It is often possible to do a focused analysis of digital devices to find any obvious relevant data and to determine if there is a possibility to find more relevant data using more advanced techniques. This triage process is helpful to reduce exam costs, while giving clients the information they need to know if more advanced analysis could be beneficial to finding data that helps prove their case.