Whoever erases a trail leaves another one. The examination shows what was destroyed, when and how, recovers what still exists and says frankly what was lost.
The intruder wipes the logs before leaving. The employee formats the laptop before returning it. Whoever forged a document adjusts the dates so they look old. These are anti-forensic techniques: actions to destroy, hide or falsify traces.
They rarely work completely. The system records the same fact in several places. Erasing one of them leaves the others, and leaves a gap where a record should be. The law also counts as a trace the latent material, that which is not in plain sight (CPP, Brazilian Code of Criminal Procedure, art. 158-A, § 3º). Much of this work is finding the latent trace.
The examination has two objectives. The first is to prove that destruction occurred, when and by what means. That is a relevant fact in itself: a disk wiped on the day of return tells a story. The second is to recover whatever is still possible, and to state what is not. When the media is damaged, the work continues in the Forensic Data Recovery laboratory.
A deleted file stays on the disk until it is overwritten. On a hard disk, a quick format also leaves the content in place. Full overwriting and SSD TRIM (the routine that actually erases freed blocks) destroy for real. Even then, the pattern of destruction shows whether it was deliberate, and when.
A deleted log usually survives elsewhere: in the page file (where the system writes parts of memory to disk), in the central log collector and in backups. Also in the file system journal (the internal diary of changes) and in the logs at the other end of the connection. On Linux servers, deleted command history and journal can come back through the structure of the file system.
This is the alteration of a file's dates so that it looks older or newer. The file system keeps more than one set of dates, the journal records the changes and the document has internal dates. When those sources disagree, the manipulation shows.
Encrypted content without the legitimate key remains unreadable, and the report says so. But the act of encrypting leaves a trail: when, with which program, under which account. Earlier copies, memory and backups may hold the content from before.
Whoever uses a program to erase traces has to install and run it. Execution is recorded in system artefacts, even after the program is removed.
Sometimes the answer is that there is no trace. The report shows what was examined, anchored in hash, so that the absence is verifiable, and not an opinion.
With destroyed evidence, the direct trace often no longer exists. That is why the degree of each conclusion must be clear to the court and the parties.
The report states as fact only what the examination confirmed. That is inherent to every expert report and needs no label. The other conclusions receive one of two classes:
The steps of the method and of the chain of custody are on the page Method and Chain of Custody.
Three situations mislead a hasty analysis. The report names each one, because that is how the opposing party can check them.
The indicator pointed to conduct that, on examination, did not occur. A coincidence of time, an automatic alert, an apparent link between people that does not hold up.
The trace exists, but does not mean what it seems. Access dates changed by the antivirus, by indexing, by cloud synchronisation or by the IT staff who opened the machine before the examination.
The trace was created or altered on purpose, to hide the attacker's actions or to point at someone else. It happens with external attackers and with insiders. The examination checks each record against independent sources the manipulator did not control.
An employee was under suspicion. Before his suspension, his equipment was preserved in confidence, without notice.
When he returned the laptop, a second preservation found the disk zeroed by a command sent to the drive's own controller: zero entropy, that is, nothing but zeros from start to finish. The pattern was neither failure nor normal use.
The examination demonstrated the deliberate wiping on the day of return. The first preservation secured the content that someone had tried to destroy.
On a Windows machine involved in an incident, the event logs had been deleted.
The examination carved for fragments in the page file.
Deleted records were recovered from that file and entered the timeline of the report.
A company finds, in its financial system, transfers made with an analyst's account. Everything seems to point to him.
In this scenario, the examination would check those records against sources the fraudster did not control: the account directory, the VPN, physical access control and use of the analyst's computer. It might find the analyst on holiday, with no connection in the period, and log entries with a broken sequence.
The report would show a forged trace: the analyst's account was used to hide who actually operated. The inquiry would move on to whoever had access to edit those records.
See also
Forensic Data Recovery → Method and Chain of Custody → Computer Forensics and Digital Investigation → Corporate Investigations and Compliance → Cloud, Identity and DevOps Forensics → Digital Authorship and Subscriber Data Disclosure →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case