Anti-Forensics - You Are Doing It Wrong (Believe Me, I'm An IR Consultant)

An incident response consultant argues that attackers who delete files, logs and tools often leave evidence in places they overlook. On Windows, the talk starts with the NTFS master file table, where entries for a deleted rclone configuration file still held credentials for an exfiltration server in a real case. The USN journal recorded an LSASS dump being written and then deleted minutes later, and the System Resource Usage Monitor database showed network activity from an exfiltration tool that never appeared on disk.

The talk then covers further artifacts. PowerShell console history is stored in a plain text file that can survive attempts to remove it, and RDP bitmap cache tiles can reveal staging folders, tool names and IP addresses. On Linux, clearing the kernel ring buffer with dmesg leaves kern.log and the journal intact, while vacuuming the journal generates its own log entry noting that it was cleared. The speaker stresses that each cleanup action can trigger another artifact.

The practical takeaway is to baseline your environment so that rare actions stand out, such as fsutil deleting the USN journal, clearing PowerShell history or vacuuming the journal, and to search for keywords across every log source rather than trusting one. In the Q&A, the speaker said that detecting deletion from memory without standard binaries is harder, and that even advanced groups make mistakes.