Slashdot Mirror


New Anti-Forensics Tools Thwart Police

rabblerouzer writes "Antiforensic tools have slid down the technical food chain, from Unix to Windows, from something only elite users could master to something nontechnical users can operate. 'Five years ago, you could count on one hand the number of people who could do a lot of these things,' says one investigator. 'Now it's hobby level.' Take, for example, TimeStomp. Forensic investigators poring over compromised systems where Timestomp was used often find files that were created 10 years from now, accessed two years ago and never modified."

6 of 528 comments (clear)

  1. Time Stamps? by iminplaya · · Score: 5, Funny

    Simple! Just cut the disk open and count the rings.

    --
    What?
    1. Re:Time Stamps? by iminplaya · · Score: 5, Funny

      Yes, and notice how I modified the time stamp AND the comment number to make appear the parent is the first post.

      --
      What?
  2. Pfft. by RealGrouchy · · Score: 5, Funny

    This has got to be old news. Over 112% of Slashdotters have been using these programs for years, since at least 3 months from now!

    - RG>

    --
    Hey pal, this isn't a pleasantforest, so don't waste my time with pleasantries!
    1. Re:Pfft. by trolltalk.com · · Score: 5, Funny
      Gee, and I thought it was a free "feature" included with every version of Windows and DOS.

      FILE0001.CHK
      FILE0002.CHK
      FILE0003.CHK
      FILE0004.CHK
      FILE0005.CHK
      ...
      FILE9999.CHK
      Unable to find COMMAND.COM. Please insert system disk and press reset.

  3. Re:A year ago... by Profane+MuthaFucka · · Score: 5, Funny

    Don't knock it. Catching cheating spouses is a great way to get laid. You've already established that they've got no problem sleeping with people other than their husbands, which is 90% of the battle usually.

    --
    Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
  4. Re:Here's a real good one by RyuuzakiTetsuya · · Score: 5, Funny

    just do some petty theft on top of that and overflow it back to 0x01.

    --
    Non impediti ratione cogitationus.