Digital Forensics Explained, 2nd Edition

Chapter 11Anti-forensics*

Anti-forensic definition and concepts

Before we can dive into exploring the definition of anti-forensics, we need to step back and understand the concept of crime investigation. Dr. Edmond Locard introduced the principle of crime investigation. He stated that when a crime is committed, there is a cross-transfer of evidence between the crime scene and the perpetrator. During a forensic investigation, we deploy science to reveal the transferred evidence and decipher its meaning. The examination process requires that the evidence is reliable and accurate (Harris, 2006).

In the world of digital forensics, evidence resides mainly on the computer storage devices in the form of files, logs, registry key entries, and other ...