Evaluación del rendimiento de herramientas anti-forenses en casos experimentales mediante la utilización de escenarios simulados.

Abstract

This article focuses on the evaluation of anti-forensic tools through the simulation of controlled scenarios that allow to know the performance when the information is compromised through the secure deletion of files, which can commonly occur in a real environment. For this purpose, four anti-forensic erasure tools were chosen under the criterion of compatibility with the Windows 10 platform, which are free distribution, have a graphic interface and also have a public license. The four tools chosen were: Hardwipe, Eraser, Secure Eraser, BitKiller. These secure erase tools were run on the Windows 10 operating system and performance tests were performed when erasing files stored on a flash-type removable drive. In order to verify the safe erasure of the files, the steps taken by the forensic computer were carried out with the purpose of evidence left by each tool. To perform the evaluation of the anti-forensic tools, the comparative and experimental method was used and to measure the performance, the metrics of response time, CPU consumption and memory during the attack were measured in relation to the total size of files in MB ( performance = seconds / MB). Finally, the results of each evaluation were compared, resulting in Hardwipe as the best safe erase tool.