Thread by @binaryz0ne

For everyone who responded to this #DFIR question below. I gathered all your feedback and put it into a repository which can be found below. I'll continue to update with everything related. #DigitalForensics #AntiForensics

github.com/ashemery/Anit-…

https://twitter.com/binaryz0ne/status/1618828773268520961

I will add what we already cover in our anti-forensics course already

JFYI, if you check my past publications, you'll notice I've covered so many of what have been mentioned here back in 2015/2016 ... but I want to see if I'm missing anything new and it turned out YES, there is one/two that I did now know. Thank you all for sharing, appreciate it.

One of the best competitions that I had the pleasure of playing back in 2012 or 2013 (don't remember), was the one that @HECFBlog did... That competition helped me learn so much about these techniques (directly/indirectly), especially those related to file systems! #DFIR

time stomping, tunneling, wiping (how and what tool), etc were one of the best.