Countering anti-forensic tactics in cybercrime investigations – a systematic literature review

Abstract With the increasing use of digital technology, people are relying on digital data for various tasks. However, this reliance has led to a rise in cyberattacks. To combat these threats, digital forensic departments are tasked with investigating such incidents. Yet, attackers continuously develop new methods to conceal their actions. These actions are considered anti-forensics, where attackers try to hamper the digital forensic investigation process by manipulating or deleting evidence to hide their tracks of malicious activities or to mislead the forensic process. Therefore, implementing effective countermeasures is essential to stop these attackers. This has resulted in a systematic review of existing literature in this domain to comprehensively understand anti-forensic techniques, evaluate current countermeasures, and identify areas for further research and development. This paper aimed to provide an overview of the anti-forensic tactics in cybercrime investigations along with their corresponding countermeasures. Digital forensics experts face many challenges in their investigations as sophisticated cyber criminals hide their tracks. The limitations of current digital forensics techniques and tools were explored, and improvements and countermeasures were suggested. Our paper aims to enhance the understanding of the digital forensics field and its associated challenges. The findings of this research are valuable as they identify key gaps in current cybersecurity practices, and these have been highlighted in the knowledge gap section.