{"id":"https://openalex.org/W7152105663","doi":"https://doi.org/10.48550/arxiv.2604.05770","title":"SoK: Understanding Anti-Forensics Concepts and Research Practices Across Forensic Subdomains","display_name":"SoK: Understanding Anti-Forensics Concepts and Research Practices Across Forensic Subdomains","publication_year":2026,"publication_date":"2026-04-07","ids":{"openalex":"https://openalex.org/W7152105663","doi":"https://doi.org/10.48550/arxiv.2604.05770"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.05770","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05770","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.05770","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050982694","display_name":"Janine Schneider","orcid":"https://orcid.org/0000-0002-7309-6440"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Schneider, Janine","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133217404","display_name":"Florian Ramming","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ramming, Florian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037354770","display_name":"Maximilian Eichhorn","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Eichhorn, Maximilian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041473323","display_name":"Gaston Pugliese","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pugliese, Gaston","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079039278","display_name":"Chris Hargreaves","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hargreaves, Chris","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025460867","display_name":"Jan Gruber","orcid":"https://orcid.org/0000-0003-1862-2900"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gruber, Jan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133187245","display_name":"Joschua Schilling","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Schilling, Joschua","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044002629","display_name":"Julian Geus","orcid":"https://orcid.org/0009-0001-8270-1964"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Geus, Julian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124814700","display_name":"Kevin Mayer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mayer, Kevin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5099097625","display_name":"Lea Uhlenbrock","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Uhlenbrock, Lea","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079124757","display_name":"Lena L. Voigt","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Voigt, Lena","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5068630039","display_name":"Frank Breitinger","orcid":"https://orcid.org/0000-0001-5261-4600"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Breitinger, Frank","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9296000003814697,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9296000003814697,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.019300000742077827,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.004900000058114529,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.6514999866485596},{"id":"https://openalex.org/keywords/legitimacy","display_name":"Legitimacy","score":0.4810999929904938},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4652999937534332},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.4083000123500824},{"id":"https://openalex.org/keywords/forensic-science","display_name":"Forensic science","score":0.3815000057220459},{"id":"https://openalex.org/keywords/strengths-and-weaknesses","display_name":"Strengths and weaknesses","score":0.36559998989105225},{"id":"https://openalex.org/keywords/qualitative-research","display_name":"Qualitative research","score":0.3508000075817108}],"concepts":[{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.6514999866485596},{"id":"https://openalex.org/C55587333","wikidata":"https://www.wikidata.org/wiki/Q1133029","display_name":"Engineering ethics","level":1,"score":0.5978000164031982},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.5386000275611877},{"id":"https://openalex.org/C46295352","wikidata":"https://www.wikidata.org/wiki/Q207982","display_name":"Legitimacy","level":3,"score":0.4810999929904938},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4652999937534332},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.4083000123500824},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.39969998598098755},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.39169999957084656},{"id":"https://openalex.org/C140505726","wikidata":"https://www.wikidata.org/wiki/Q495304","display_name":"Forensic science","level":2,"score":0.3815000057220459},{"id":"https://openalex.org/C63882131","wikidata":"https://www.wikidata.org/wiki/Q17122954","display_name":"Strengths and weaknesses","level":2,"score":0.36559998989105225},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.3508000075817108},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.3441999852657318},{"id":"https://openalex.org/C153997805","wikidata":"https://www.wikidata.org/wiki/Q42240","display_name":"Research ethics","level":2,"score":0.3434999883174896},{"id":"https://openalex.org/C156325361","wikidata":"https://www.wikidata.org/wiki/Q1152864","display_name":"Grounded theory","level":3,"score":0.3296000063419342},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.3165999948978424},{"id":"https://openalex.org/C3018587665","wikidata":"https://www.wikidata.org/wiki/Q7268696","display_name":"Qualitative analysis","level":3,"score":0.3131999969482422},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.30869999527931213},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2896000146865845},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2596000134944916},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.2565999925136566},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.2538999915122986}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.05770","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05770","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.05770","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05770","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.53490149974823}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Anti-forensics":[0],"includes":[1],"a":[2,72,125],"growing":[3],"set":[4],"of":[5,34,59,65,75,132],"techniques":[6,89],"designed":[7],"to":[8,40],"obstruct":[9],"forensic":[10,28,99],"analysis.":[11],"While":[12],"cybercriminals":[13],"increasingly":[14],"rely":[15],"on":[16,78],"these":[17,114],"methods,":[18,105],"they":[19],"also":[20,52,111],"help":[21],"researchers":[22],"identify":[23,102],"and":[24,46,62,82,90,101,107,120,128],"remedy":[25],"weaknesses":[26],"in":[27,48,96],"tools,":[29],"advancing":[30],"the":[31,57,63,66,87],"overall":[32],"robustness":[33],"digital":[35,98],"forensics.":[36],"Despite":[37],"repeated":[38],"efforts":[39],"define":[41],"it,":[42],"anti-forensics":[43],"remains":[44],"vague":[45],"inconsistent":[47],"its":[49],"use.":[50],"It":[51],"poses":[53],"ethical":[54],"challenges":[55],"regarding":[56],"appropriateness":[58],"research":[60,104,119],"practices":[61],"legitimacy":[64],"field":[67],"itself.":[68],"This":[69,109],"article":[70],"presents":[71],"systematic":[73],"analysis":[74],"123":[76],"publications":[77],"anti-forensics,":[79],"combining":[80],"qualitative":[81],"quantitative":[83],"methods.":[84],"We":[85],"quantify":[86],"main":[88],"attack":[91],"vectors,":[92],"examine":[93],"their":[94],"occurrence":[95],"different":[97],"subdomains,":[100],"typical":[103],"motivations,":[106],"applications.":[108],"work":[110],"discusses":[112],"what":[113],"findings":[115],"mean":[116],"for":[117,123],"future":[118],"proposes":[121],"directions":[122],"building":[124],"more":[126],"coherent":[127],"ethically":[129],"grounded":[130],"understanding":[131],"anti-forensics.":[133]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-09T00:00:00"}