🕶️ Anti-Forensics

Forged Image Detection

https://29a.ch/photo-forensics/#forensic-magnifier Images can be forged or cloned. Regions can be manipulated with. Hard to detect with naked eye.

Windows https://tyeyeah.github.io/2021/08/02/2021-08-02-Bypass-Anti-Virus/ macOS Linux

Alternative data stream Alternate data streams. Specific for Windows. See more here. Are there such streams for other OS?

macOS From Apple’s official documentation: In some cases, the contents of a volume are sufficiently secret that it is not appropriate to log them.

A software that could be used for anti-forensics. By default, configs are at /etc and named usbkill.