The average personal computer is a security nightmare ,but what if i were to tell you there was a way around this, a way to make windows secure? VPNs , proxies , and Tor only get you so far , but what do you do when they’ve traced it to your computer? Anti-forensics are designed for this situation , to prevent them from proving you’ve done anything wrong even if they have your computer , it’s the art of leaving no trace , it is combating common forensic tools in preventing a penetration for forensic tests on your computer. Anti forensics can pretty much be summed up in one famous quote :
“Make it hard for them to find you and impossible for them to prove they’ve found you” – Scott Berinato
This article will teach you everything you need to know about anti-forensics to protect you and your privacy alike , with that being said,let’s get started.
Disabling Time Stamps
Using time stamps , forensic experts can build a ‘digital time-line’, this can be very compelling evidence when cross-reference with other known evidence. In order to strengthen security , we must disable these logs.
Step 1 User Assist File
In the windows registry settings that store logs and there respective dates of all launched programs , forensic experts can use this information to build a digital time-line of your activity on the computer , disabling these settings is a key aspect of anti-forensics.HKEY_Current_UserSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
You should see two sub keys called Count . delete both these keys. Now right-click the USERASSIST key and create a new key named Settings. In this key create DWORD value named NoLog set the value 1.Windows will no longer store logs of your activity.
Step 2 Last Access Logs
Next we will disable the last access in windows. What last access is ,is a setting on windows that allows you to see when you opened , modified , and /or created files on your computer and is similar to the UserAssist registry key. By disabling this ,forensic experts won’t easily be able to tell when you’ve accessed programs or files on your computer.
To disable last access , open command prompt on your computer , if on vista or windows 7 make sure to run as administrator. In command prompt type the following.
fsutil behavior set disablelastaccess 1
Last access has now been disabled , in order for it to take effect you must restart your computer.
Encrypting you Computer
It is very important to make sure that your computer is encrypted in the case an unwanted visitor is trying to get access to your computer , they will not be able to get access to your computer if it’s encrypted.
Step1 TrueCrypt – Download here
To encrypt your computer , you can use TrueCrypt , a free program that allow you to encrypt your computer. When encrypting with TrueCrypt , you have two options ; the first one is to create a hidden container. A hidden container is an operating system that is impossible to prove that it exists.
When creating a hidden container you will have three different passwords
1.1 The first would be for your decoy system , the operating system you would show someone forcing you to login your computer.
1.2 The second password would be for you outer volume , the operating system you would show someone forcing ou to login to the second partition on your computer
1.3 Third password is for the hidden operating system on the second partition of your computer , this operating system is placed in the inner volume , and is impossible to prove that it exists ( it seems to be RAW data)
The second option is to just encrypt your hard drive . This is also very secure , but you ma be forced to give up your password due to court-order in this situation many would think to simply say that they forgot their password , but doing so could get you held in contempt of court. With normal drive encryption you computer is just as secure , encryption wise, and you will have a single password.
Step 2 Encrypt you keystrokes – Download here
It is imperative that you protect yourself from keyloggers , hackers will use these steal log-in information and credit cards , the government uses keyloggers to spy on you. Encrypting you keystrokes is an excellent technique to protect yourself from keyloggers , it renders any tracking of typed keystrokes completely useless. Keyscrambler is a program which can do just that , encrypting all keystrokes sent to a variety of popular applications , its premium version supports 170+ programs , though it is not free and costs a hefty $45 , you can alternatively use the free version , but it is obsolete when compared to the premium.
Making encryption secure
Encryption is pointless if it can be easily bypassed or overcome . You need to make sure that the encryption is secure too.
Step 1 Make sure your password is strong
Even with your computer encrypted , it is still vulnerable. Make sure your password is good ( for ideal security , your password should be twenty or more characters , with symbols , numbers and random capitals , and a special symbol.
If your password is not strong enough , you can change it by right clicking your encrypted drive in TrueCrypt and selecting ‘Change Password’.
Step 2 Create a Locked Screen Saver
Encryption is point less if the fedds get to your computer while its running. They can use live forensic tools that don’t need the movement or shutdown of a computer. A very simple technique to overcome this is to create a locked screen saver.
Step 3 Get a good Anti-Virus
This may seem obvious , but all this is pointless if you get infected with a keylogger that takes screen shots. Having a good anti-virus is one of the most important things one can do. Many people make the mistake of having a poor anti-virus; AVG , Norton Mcafee , all are awful anti-viruses.The only anti-virus programs i find worthy of my recommendation are ESET Nod32 , Kaspersky and BitDefender; these anti-viruses are
very good, but quality comes with a price-tag and you might find them a bit too expensive for your taste.
Disable and Remove USB Logs
Next on the list of Anti-forensics is to disable logs of USB activity , flash drives etc.. This can be valuable if you have a flashdrive with sensitive data and you don’t want any logs of it ever being plugged in to your computer.
Step 1 Delete the USBSTOR Registry Setting
In your registry there is a key called USBSTOR , which logs all information on USB devices interpreted by your computer; brand name and model , size of the device , date and time plugged in etc. Forensic experts can and wil use this to match your computer to USB devices.
Deleting this registry key is not as simple as most otheres , it has special permissions that can be hard to bypass. To delete this key, we will use a tool from Microsoft called PsExec , you can download it here.
Once you have downloaded it , extract the RAR file to your desktop. Open up CMD (as administrator) and type the following into the command line;
cd C:Users%Username%DesktopPsExec
This will cause CMD to navigate to your desktop , once this is done type the following into the command line;
psexec -i -d -s c:windowsregedit.exe
The registry Editor window will open , with full permissions. Browse to the following directory
HKEY_LOCAL_MACHINESystemCurrentControlSetEnumUSBSTOR
Now ,right click ‘USBSTOR‘ and hit ‘Delete’, then confirm that you want to delete the key; congratulations the key has been deleted
Step 2 Delete the Setupapi.log File
The setupapi.log is a plain-text file that stores the list of installed USB devices and their drivers. We will delete it with a program called CCleaner.
CCleaner is actually one of the best tools that anti-forensic has to offer, it does a great job of securely wiping files for specific instructions.
Windows Security Misc.
This section is for various information that is important to anti-forensics , but isn’t quite big enough to have its own section within the article.
Step 1 Disable System Restore Points
System Restore Points can be used to bring your computer back to a date when it wasnt secure and can also be used to restore overwritten files.To disable system restore point right click Computer and click Properties now click Advanced system Settings. Under System Protection click Configure.Now select Turn off system Protection and apply it.
Step 2 Disable Send error report to Microsoft
This is self explanatory , we obviously don’t want Microsoft to have all of our logs/ crashed programs.
To do this , go to start menu and search problem reporting settings and then click on Choose how to report problems, click ‘ Change Report Settings for all users and then set it to Never check for solutions.
Step 3 Wipe with CCleaner – Download here
Like mentioned above , this is the heart of anti-forensics right here. CCleaner is actually one of the most powerful Anti-Forensic tools ‘IF’ used correctly.As it turns out , when deleting files , you DO NOT need to do multiple overrides. With modern hard drives , one overwrite really is enough to delete a file beyond repair , even though it is popular to belief that you need several overrides to be secure. With CCleaner , i would recommend two overrides , just in-case it misses something the first time around(remember it is freeware)
Once you have CCleaner installed , run it as administrator , go to settings and make sure you have it set to overwrite deleted data with three passes.
Go back to CCleaner and check everything then hit Run Cleaner. You might want to leave this on overnight depending on how many files it has to clean.
Do this every time you are done with a major hacking job. When using CCleaner normally (what should be every time you are done with your computer) uncheck Wipe Free Space , this will cut down the time from hours to a few minutes.
Step 4 Disable Debugging Upon Failure
This keeps logs of your computers failures and blue screen info.
To disable it , right click Computer and go to Advanced System Settings , now go to Start Up and Recovery. Now set Debugging Information to NONE.
Step 5 Disable Windows Event Logging
Windows keeps logs of all events on the computer. First , before we disable , we must clear all the logs.To disable it , go to control panel , then System and Security.
Now , click administrative Tools and then Event Viewer. In either pane of the Event Viewer window, right click System and then select Clear All Events , click no to the dialog box that will open.
Now we must disable Windows Event Logging. Go to Run and type in ‘msconfig‘ , then go to ‘Services’ and make sure ‘Hide all Microsoft Services’
is unchecked. Now scroll down until you find ‘Windows Event Logging’ and uncheck it. Restart your computer right away.
Step 6 Disable Windows Hibernation
You may as well hand your computer over to the feds if they raid your house and your computer is in hibernation. Also , putting your computer into hibernation is pretty much taking a screen shot of your RAM that gets saved to your hard drive.
Open control panel. Click System an Security, then click ‘Power Options’ Click ‘change plan settings’ for your current power plan.
Now click Change advanced power settings. Expand Sleep, then expand hibernate after. Enter 0 for Setting. Hibernation is now disabled.
Hope that explains everything in detail as to how easily the feds/forensic experts can bust you. Stay safe and anonymous , leave no trace!!
