How should destructive and anti-forensic activity be reported?¶
The practical answer¶
Destructive and anti-forensic activity should be reported by separating missing evidence, observed alteration, technical effect, intent and attribution.
The key evidential caution¶
The dangerous assumption is that any gap or loss justifies stating that the offender destroyed evidence.
It does not.
A defensible report should distinguish:
Key points¶
- logs not generated
- records lost through retention
- records cleared
- files deleted
- data overwritten
- timestamps altered
- security controls disabled
- systems corrupted
- evidence fabricated
- response actions that changed the scene
Use precise language.
“The log was unavailable” is different from “the log was deliberately cleared.”
“A wiping tool was present” is different from “the storage was successfully wiped.”
“A timestamp was inconsistent” is different from “the offender altered it.”
Explain the account, process, command, timing and resulting effect where known.
State whether intent is directly evidenced, strongly supported or uncertain.
Keep account attribution separate from personal attribution.
Also identify which conclusions rely on direct records and which rely on inference from gaps. A report should not allow the phrase anti-forensics to convert uncertainty into certainty. Explain what evidence would normally exist, why its absence matters and what alternative causes were considered.
Where evidence was altered by responders, identify that transparently. Necessary containment may change files, terminate sessions or overwrite logs. Those changes should not be attributed to the offender, and they should form part of the documented response timeline.
State those responder effects separately and clearly.
Operational takeaway¶
Report missing, altered and destroyed evidence as separate findings, and support conclusions about intent, success and responsibility with their own evidence.