Which anti-forensics techniques are commonly used, and how can defenders mitigate them?

• A. Steganography.
• B. Two-factor authentication.
• C. Disabling antivirus.
• D. Timestomping, data obfuscation, encryption, artifact deletion; mitigations include tamper-evident logs, multiple data sources, known-good baselines, robust chain of custody.

Answer: (D)

Anti-forensics revolves around techniques that hinder investigations by manipulating data and evidence, making it harder to reconstruct what happened. The strongest answer name-checks several common methods and pairs them with practical defenses. Timestomping changes file timestamps to distort the sequence of events, so defenders rely on tamper-evident logs and synchronized clocks to detect inconsistencies and ensure a reliable timeline. Data obfuscation hides or misleads data, which is countered by using multiple data sources and baselining to spot deviations that don’t fit normal patterns. Encryption shields content from investigators, so the defense is to protect evidence integrity and accessibility through proper key management and corroborating data (for example, capturing metadata and related artifacts that can still be analyzed without exposing plaintext). Artifact deletion removes traces, which is countered by centralized, tamper-evident logging, long-term storage that resists alteration, and strict chain of custody to preserve and prove the provenance of evidence.

The listed mitigations—tamper-evident logs, multiple data sources, known-good baselines, and robust chain of custody—provide a coherent set of defenses that address the ways anti-forensics can hide, corrupt, or erase evidence. Other options touch on related concepts (steganography as a hiding technique, or disabling protections as an attacker tactic) but don’t offer the same integrated approach to both the techniques and their practical mitigations.