What is anti-forensics and provide an example technique.

• A. Practices to improve digital privacy; example: encryption only on backups.
• B. Methods for forensic investigators to speed up data collection; example: imaging drives.
• C. Techniques aimed to hinder forensic investigations; example: data wiping, steganography, timestamp manipulation.
• D. Procedures to ensure legal compliance; example: maintaining chain of custody.

Answer: (C)

Anti-forensics is the practice of trying to defeat, hinder, or mislead digital forensic analysis. The aim is to make evidence harder to find, reconstruct, or trust. An example technique is data wiping, which overwrites or destroys data so it cannot be recovered, complicating or preventing analysis. Steganography hides data inside other files, so a examiner may not notice the hidden content without specialized tools. Timestamp manipulation, or timestomping, changes file metadata to distort the apparent sequence of events, which can mislead investigators about when actions occurred. These methods are used to obstruct investigations, make it harder to establish a clear timeline, and undermine evidence integrity. Forensic practitioners counter them by looking for residual artifacts, cross-checking with logs from other sources, analyzing unallocated or slack space, checking for metadata inconsistencies, and corroborating evidence across multiple data sources.