IT Forensics · Linux

Detecting log manipulation and anti-forensics – uncovering evidence tampering on Linux systems

Experienced attackers often deliberately attempt to cover their tracks by deleting or altering log files, as well as by using other anti-forensic techniques, in order to make a subsequent investigation more difficult or to thwart it altogether.

Enquire without obligation

However, such attempts at manipulation often leave their own indirect traces, such as gaps in otherwise complete log series or inconsistencies between different, independent data sources.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We systematically examine systems for evidence of log tampering and other anti-forensic techniques, cross-check available data sources and document any detected attempts at tampering in a traceable manner.

Typical areas of application

•Detection of deleted or altered log files
•Identification of further anti-forensic techniques, such as timestamp manipulation
•Cross-checking independent data sources to identify gaps
•Assessment of the reliability of existing log data
•Incident Response on Linux Systems
•Judicial and non-judicial expert reports

This is how an anti-forensics investigation is carried out

Once the backup has been completed, the available log files are checked for completeness and for any indications of subsequent alterations. In addition, independent data sources such as the central Log-Server or file system metadata are cross-checked to detect any covert manipulation.

Why is anti-forensics analysis relevant to forensics?

The detection of deliberate attempts to cover one’s tracks is often in itself a strong indication of a deliberate, targeted compromise and can provide further insights into an attacker’s modus operandi and level of expertise.

As tampered logs are no longer entirely reliable when used as the sole basis of evidence, cross-checking against independent data sources is essential for reaching a sound forensic conclusion.

Frequently Asked Questions

What anti-forensics techniques are commonly used on Linux?+
These include, amongst other things, the deliberate deletion or truncation of log files, the manipulation of timestamps and the deactivation of logging mechanisms.
How are deleted log entries detected?+
By cross-referencing with independent, redundant data sources such as central Log-Servern, and by checking for inconsistencies in consecutive log sequences.
Can the complete deletion of logs prevent a forensic investigation?+
It makes this considerably more difficult, but does not, as a rule, render it completely impossible, given the other system artefacts available.

🔗 Related topics

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „detecting log manipulation and anti-forensics"? LanCologne can assist you with the court-admissible preservation of digital evidence and the transparent analysis of relevant Linux artefacts.

Get in touch now