[Introduction to Incident Handling and Response] BadGuy Bob hid files in the slack space, changed the file headers, hid suspicious files in executables, and changed the metadata for all types of files on his hacker laptop. What has he committed?

The actions described—hiding files in slack space, altering file headers (obfuscation), embedding files within executables (data hiding), and changing file metadata (timestomping)—are all well-established techniques of anti-forensics. Anti-forensics encompasses any method used to impede a digital forensic investigation. The primary goals are to prevent evidence from being discovered, to disrupt the analysis of collected evidence, or to cast doubt on the evidence's authenticity. Bob's actions are a deliberate attempt to conceal his activities and mislead any potential forensic examiner.

B. Adversarial mechanics: This is not a standard or recognized term within the digital forensics or incident response communities.
C. Felony: This is a legal classification for a serious crime. While the actions might be part of a felony, the term itself describes the legal consequence, not the technical methods used.
D. Legal hostility: This is a vague and non-technical phrase. The actions are hostile to a forensic investigation, but "legal hostility" is not the correct term for these techniques.

1. Kornblum

J. (2007). "Using ssdeep to find similar files." Digital Investigation

4(Supplement)

53-55. This article

while focused on fuzzy hashing

discusses the forensic challenge of identifying modified files

a problem directly caused by anti-forensic techniques like changing headers and metadata. (DOI: https://doi.org/10.1016/j.diin.2007.06.011)

2. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.3

"Data Hiding

" explicitly discusses techniques such as hiding data in slack space and embedding it within other files. Section 3.3.4

"Data Modification

" covers the alteration of file metadata like timestamps.

3. Garfinkel

S. (2007). "Anti-Forensics: Techniques

Detection and Countermeasures." Proceedings of the 2nd International Conference on i-Warfare and Security (ICIW 2007)

Naval Postgraduate School

Monterey

CA. This foundational paper defines anti-forensics and categorizes the techniques

including data hiding (e.g.

in slack space) and data obfuscation (e.g.

changing file headers).

4. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. Chapter 11

"Data Hiding and Recovery

" details methods like steganography (hiding files in executables) and using file slack for concealment

classifying them as challenges to forensic investigation.