Toward Understanding the Challenges and Countermeasures in Computer Anti-Forensics

The term computer anti-forensics (CAF) generally refers to a set of tactical and technical measures intended to circumvent the efforts and objectives of the field of computer and network forensics (CF). Many scientific techniques, procedures, and technological tools have evolved and effectively applied in the field of CF to assist scientists and investigators in acquiring and analyzing digital evidence for the purpose of solving cases that involve the use or misuse of computer systems. CAF has emerged as a CF counterpart that plants obstacles throughout the path of computer investigations. The purpose of this paper is to highlight the challenges introduced by anti-forensics, explore various CAF mechanisms, tools, and techniques, provide a coherent classification for them, and discuss their effectiveness. Moreover, the authors discuss the challenges in implementing effective countermeasures against these techniques. A set of recommendations are presented with future research opportunities.