{"id":"https://openalex.org/W218419718","doi":null,"title":"Anti-Forensics: Techniques, Detection and Countermeasures","display_name":"Anti-Forensics: Techniques, Detection and Countermeasures","publication_year":2007,"publication_date":"2007-03-01","ids":{"openalex":"https://openalex.org/W218419718","mag":"218419718"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.109.5063","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.109.5063","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.simson.net/clips/academic/2007.ICIW.AntiForensics.pdf","raw_type":"text"},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077305737","display_name":"Simson Garfinkel","orcid":"https://orcid.org/0000-0003-1294-2831","observed_orcids":["https://orcid.org/0000-0003-1294-2831"]},"institutions":[{"id":"https://openalex.org/I1321014770","display_name":"Association for Computing Machinery","ror":"https://ror.org/03wsadn68","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1321014770"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Simson Garfinkel","raw_affiliation_strings":["Association For Computing Machinery"],"raw_orcid":"https://orcid.org/0000-0003-1294-2831","affiliations":[{"raw_affiliation_string":"Association For Computing Machinery","institution_ids":["https://openalex.org/I1321014770"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5077305737"],"corresponding_institution_ids":["https://openalex.org/I1321014770"],"apc_list":null,"apc_paid":null,"fwci":8.7693,"has_fulltext":false,"cited_by_count":126,"citation_normalized_percentile":{"value":0.97523016,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anti-forensics","display_name":"anti-forensics","score":0.9959999918937683},{"id":"https://openalex.org/keywords/countermeasures","display_name":"countermeasures","score":0.7429999709129333},{"id":"https://openalex.org/keywords/encrypted-file-systems","display_name":"encrypted file systems","score":0.8040000200271606},{"id":"https://openalex.org/keywords/anti-debugging","display_name":"anti-debugging","score":0.8769999742507935},{"id":"https://openalex.org/keywords/rootkits","display_name":"rootkits","score":0.9440000057220459},{"id":"https://openalex.org/keywords/information-hiding","display_name":"information hiding","score":0.4059999883174896}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6989087462425232},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.6592830419540405},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.6339982151985168},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5984095931053162},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.50633704662323},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.503034770488739},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.4918198883533478},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.44673678278923035},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14186415076255798}],"mesh":[],"locations_count":4,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.109.5063","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.109.5063","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.simson.net/clips/academic/2007.ICIW.AntiForensics.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.840.9207","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.840.9207","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.dtic.mil/get-tr-doc/pdf?AD%3DADA576161%26Location%3DU2%26doc%3DGetTRDoc.pdf","raw_type":"text"},{"id":"pmh:oai:calhoun.nps.edu:10945/44248","doi":null,"is_oa":false,"landing_page_url":"https://hdl.handle.net/10945/44248","pdf_url":null,"source":{"id":"https://openalex.org/S4306400952","display_name":"Calhoun: The Naval Postgraduate School Institutional Archive (Naval Postgraduate School)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I35364215","host_organization_name":"Naval Postgraduate School","host_organization_lineage":["https://openalex.org/I35364215"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference Paper"},{"id":"mag:218419718","doi":null,"is_oa":false,"landing_page_url":"https://apps.dtic.mil/dtic/tr/fulltext/u2/a576161.pdf","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","score":0.4399999976158142,"id":"https://metadata.un.org/sdg/16"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W1574063504","https://openalex.org/W2117882778","https://openalex.org/W2151185692","https://openalex.org/W2169305063","https://openalex.org/W2341111334"],"related_works":["https://openalex.org/W4234377435","https://openalex.org/W2743195370","https://openalex.org/W1829741967","https://openalex.org/W3097838915","https://openalex.org/W7125404305","https://openalex.org/W7095294568","https://openalex.org/W7095751982","https://openalex.org/W2060155568","https://openalex.org/W1570969260","https://openalex.org/W1798394196"],"abstract_inverted_index":{"Abstract:":[0],"Computer":[1],"Forensic":[2],"Tools":[3],"(CFTs)":[4],"allow":[5,101],"investigators":[6],"to":[7,65,70,81,92,103],"recover":[8],"deleted":[9],"files,":[10],"reconstruct":[11],"an":[12,122],"intruder\u2019s":[13],"activities,":[14],"and":[15,25,40,56,141,145,155,193],"gain":[16],"intelligence":[17],"about":[18],"a":[19,147],"computer\u2019s":[20],"user.":[21,87],"Anti-Forensics":[22],"(AF)":[23],"tools":[24,75,106,152,163,184],"techniques":[26,89,135],"frustrate":[27],"CFTs":[28,64],"by":[29,46,57,164,172],"erasing":[30],"or":[31],"altering":[32],"information;":[33,42],"creating":[34],"\u201cchaff":[35],"\u201d":[36,60],"that":[37,62,126],"wastes":[38],"time":[39],"hides":[41],"implicating":[43],"innocent":[44],"parties":[45],"planting":[47],"fake":[48],"evidence;":[49],"exploiting":[50,165],"implementation":[51],"bugs":[52,166],"in":[53,116,167],"known":[54],"tools;":[55],"leaving":[58],"\u201ctracer":[59],"data":[61],"causes":[63],"inadvertently":[66],"reveal":[67],"their":[68,105,191],"use":[69],"the":[71,83,86,94,112,173,180],"attacker.":[72],"Traditional":[73],"AF":[74,125,134,151],"like":[76],"disk":[77,142],"sanitizers":[78],"were":[79,90],"created":[80],"protect":[82,93],"privacy":[84],"of":[85,97,124,149,182],"Anti-debugging":[88],"designed":[91],"intellectual":[95],"property":[96],"compiled":[98],"code.":[99],"Rootkits":[100],"attackers":[102],"hide":[104],"from":[107],"other":[108],"programs":[109],"running":[110],"on":[111],"same":[113],"computer.":[114],"But":[115],"recent":[117,150],"years":[118],"there":[119],"has":[120],"been":[121],"emergence":[123],"directly":[127],"target":[128],"CFTs.":[129],"This":[130],"paper":[131],"categorizes":[132],"traditional":[133],"such":[136],"as":[137,170],"encrypted":[138],"file":[139],"systems":[140],"sanitization":[143],"utilities,":[144],"presents":[146,188],"survey":[148],"including":[153],"Timestomp":[154],"Transmogrify.":[156],"It":[157],"discusses":[158,194],"approaches":[159],"for":[160,185,190],"attacking":[161],"forensic":[162],"those":[168],"tools,":[169],"demonstrated":[171],"\u201c42.zip\u201d":[174],"compression":[175],"bomb.":[176],"Finally,":[177],"it":[178],"evaluates":[179],"effectiveness":[181],"these":[183],"defeating":[186],"CFTs,":[187],"strategies":[189],"detection,":[192],"countermeasures.":[195]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":12},{"year":2017,"cited_by_count":9},{"year":2016,"cited_by_count":5},{"year":2015,"cited_by_count":8},{"year":2014,"cited_by_count":7},{"year":2013,"cited_by_count":12},{"year":2012,"cited_by_count":13}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}