{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T14:32:00Z","timestamp":1760711520505,"version":"3.44.0"},"publisher-location":"Cham","reference-count":32,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783032006370"},{"type":"electronic","value":"9783032006356"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-032-00635-6_8","type":"book-chapter","created":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T13:36:14Z","timestamp":1754660174000},"page":"131-148","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["The Impact of\u00a0Anti-forensic Techniques on\u00a0Data-Driven Digital Forensics: Anomaly Detection Case Study"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-2832-1939","authenticated-orcid":false,"given":"Zuzana","family":"Hennelov\u00e1","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3120-1695","authenticated-orcid":false,"given":"Eva","family":"Markov\u00e1","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1967-8802","authenticated-orcid":false,"given":"Pavol","family":"Sokol","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,8,9]]},"reference":[{"key":"8_CR1","doi-asserted-by":"crossref","unstructured":"Abdullahi, Z.H., Singh, S.K., Hasan, M.: The impact of anti-forensic techniques on forensic investigation challenges. In: Computer Science Engineering and Emerging Technologies, pp. 697\u2013701. CRC Press (2024)","DOI":"10.1201\/9781003405580-113"},{"key":"8_CR2","doi-asserted-by":"publisher","unstructured":"Adamu, B.Z., Karabatak, M., Ertam, F.: A conceptual framework for database anti-forensics impact mitigation. In: 8th International Symposium on Digital Forensics and Security (ISDFS 2020), pp.\u00a01\u20136. IEEE (2020). https:\/\/doi.org\/10.1109\/ISDFS49300.2020.9116375","DOI":"10.1109\/ISDFS49300.2020.9116375"},{"issue":"1","key":"8_CR3","first-page":"551","volume":"4","author":"M Alazab","year":"2009","unstructured":"Alazab, M., Venkatraman, S., Watters, P.: Effective digital forensic analysis of the NTFS disk image. Ubiq. Comput. Commun. J. 4(1), 551\u2013558 (2009)","journal-title":"Ubiq. Comput. Commun. J."},{"key":"8_CR4","volume":"48","author":"F Breitinger","year":"2024","unstructured":"Breitinger, F., Hilgert, J.N., Hargreaves, C., Sheppard, J., Overdorf, R., Scanlon, M.: DFRWS EU 10-year review and future directions in digital forensic research. Forensic Sci. Int. Digit. Investig. 48, 301685 (2024)","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"8_CR5","doi-asserted-by":"crossref","unstructured":"Breitinger, F., Studiawan, H., Hargreaves, C.: SOK: timeline based event reconstruction for digital forensics: terminology, methodology, and current challenges. arXiv preprint (2025)","DOI":"10.1016\/j.fsidi.2025.301932"},{"key":"8_CR6","unstructured":"Carrier, B.: File System Forensic Analysis. Addison-Wesley Professional (2005)"},{"issue":"3","key":"8_CR7","first-page":"31","volume":"8","author":"GS Cho","year":"2016","unstructured":"Cho, G.S.: Data hiding in NTFS timestamps for anti-forensics. Int. J. Internet Broadcasting Commun. 8(3), 31\u201340 (2016)","journal-title":"Int. J. Internet Broadcasting Commun."},{"key":"8_CR8","doi-asserted-by":"publisher","unstructured":"Choi, J., Park, J., Lee, S.: Forensic exploration on windows file history. Forensic Sci. Int. Digit. Investig. 36 (2021). https:\/\/doi.org\/10.1016\/j.fsidi.2021.301134","DOI":"10.1016\/j.fsidi.2021.301134"},{"key":"8_CR9","doi-asserted-by":"publisher","first-page":"S66","DOI":"10.1016\/j.diin.2016.04.006","volume":"18","author":"K Conlan","year":"2016","unstructured":"Conlan, K., Baggili, I., Breitinger, F.: Anti-forensics: furthering digital forensic science through a new extended, granular taxonomy. Digit. Investig. 18, S66\u2013S75 (2016)","journal-title":"Digit. Investig."},{"key":"8_CR10","doi-asserted-by":"publisher","unstructured":"Du, X., Le, Q., Scanlon, M.: Automated artefact relevancy determination from artefact metadata and associated timeline events. In: 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), pp.\u00a01\u20138. IEEE (2020). https:\/\/doi.org\/10.1109\/CyberSecurity49315.2020.9138874","DOI":"10.1109\/CyberSecurity49315.2020.9138874"},{"issue":"12","key":"8_CR11","doi-asserted-by":"publisher","first-page":"5302","DOI":"10.3390\/app14125302","volume":"14","author":"R Gonz\u00e1lez Arias","year":"2024","unstructured":"Gonz\u00e1lez Arias, R., Bermejo Higuera, J., Rainer Granados, J.J., Bermejo Higuera, J.R., Sicilia Montalvo, J.A.: Systematic review: anti-forensic computer techniques. Appl. Sci. 14(12), 5302 (2024)","journal-title":"Appl. Sci."},{"key":"8_CR12","doi-asserted-by":"crossref","unstructured":"Hermon, R., Singh, U., Singh, B.: Forensic techniques to detect hidden data in alternate data streams in NTFS. In: 2022 IEEE Bombay Section Signature Conference (IBSSC), pp.\u00a01\u20136 (2022)","DOI":"10.1109\/IBSSC56953.2022.10037507"},{"key":"8_CR13","doi-asserted-by":"publisher","first-page":"11065","DOI":"10.1109\/ACCESS.2022.3142508","volume":"10","author":"AR Javed","year":"2022","unstructured":"Javed, A.R., Ahmed, W., Alazab, M., Jalil, Z., Kifayat, K., Gadekallu, T.R.: A comprehensive survey on computer forensics: state-of-the-art, tools, techniques, challenges, and future directions. IEEE Access 10, 11065\u201311089 (2022)","journal-title":"IEEE Access"},{"issue":"3","key":"8_CR14","doi-asserted-by":"publisher","first-page":"856","DOI":"10.1111\/1556-4029.15240","volume":"68","author":"D Joo","year":"2023","unstructured":"Joo, D., Lee, J., Jeong, D.: A reference database of windows artifacts for file-wiping tool execution analysis. J. Forensic Sci. 68(3), 856\u2013870 (2023)","journal-title":"J. Forensic Sci."},{"key":"8_CR15","unstructured":"Kanstr\u00e9n, T.: A look at precision, recall, and f1-score (2020). https:\/\/towardsdatascience.com\/a-look-at-precision-recall-and-f1-score-36b5fd0dd3ec"},{"key":"8_CR16","unstructured":"Liu, V., Brown, F.: Bleeding-edge anti-forensics. In: Infosec World Conference & Expo, MIS Training Institute (2006)"},{"key":"8_CR17","doi-asserted-by":"publisher","unstructured":"Majed, H., Noura, H.N., Chehab, A.: Overview of digital forensics and anti-forensics. In: 8th International Symposium on Digital Forensics and Security (ISDFS 2020), pp.\u00a01\u20136. IEEE (2020). https:\/\/doi.org\/10.1109\/ISDFS49300.2020.9116367","DOI":"10.1109\/ISDFS49300.2020.9116367"},{"key":"8_CR18","doi-asserted-by":"publisher","unstructured":"Markova, E., Sokol, P., Kovacova, K.: Detection of relevant digital evidence in the forensic timelines. In: 2022 14th International Conference on Electronics, Computers and Artificial Intelligence (ECAI) (2022). https:\/\/doi.org\/10.1109\/ECAI54874.2022.9847438","DOI":"10.1109\/ECAI54874.2022.9847438"},{"key":"8_CR19","doi-asserted-by":"publisher","DOI":"10.1016\/j.dib.2024.110693","volume":"55","author":"E Markov\u00e1","year":"2024","unstructured":"Markov\u00e1, E., Sokol, P., Kri\u0161\u00e1kov\u00e1, S.P., Kov\u00e1\u010dov\u00e1, K.: Dataset of windows operating system forensics artefacts. Data Brief 55, 110693 (2024)","journal-title":"Data Brief"},{"key":"8_CR20","volume":"33","author":"D Mothi","year":"2020","unstructured":"Mothi, D., Janicke, H., Wagner, I.: A novel principle to validate digital forensic models. Forensic Sci. Int. Digit. Investig. 33, 200904 (2020)","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"8_CR21","doi-asserted-by":"crossref","unstructured":"Oh, J., Lee, S., Hwang, H.: Forensic detection of timestamp manipulation for digital forensic investigation. IEEE Access 12 (2024)","DOI":"10.1109\/ACCESS.2024.3395644"},{"key":"8_CR22","doi-asserted-by":"publisher","unstructured":"Pajek, P., Pimenidis, E.: Computer anti-forensics methods and their impact on computer forensic investigation. In: Communications in Computer and Information Science, vol.\u00a045, pp. 145\u2013155 (2009). https:\/\/doi.org\/10.1007\/978-3-642-04062-7_16","DOI":"10.1007\/978-3-642-04062-7_16"},{"key":"8_CR23","volume":"32","author":"D Palmbach","year":"2020","unstructured":"Palmbach, D., Breitinger, F.: Artifacts for detecting timestamp manipulation in NTFS on windows and their reliability. Forensic Sci. Int. Digit. Investig. 32, 300920 (2020)","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"8_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsisyn.2022.100313","volume":"6","author":"P Reedy","year":"2023","unstructured":"Reedy, P.: Interpol review of digital evidence for 2019\u20132022. Forensic Sci. Int. Synergy 6, 100313 (2023)","journal-title":"Forensic Sci. Int. Synergy"},{"key":"8_CR25","doi-asserted-by":"crossref","unstructured":"Schmitt, L., Kul, G.: Anti forensic measures and their impact on forensic investigations. In: Adversarial Multimedia Forensics, pp. 237\u2013261. Springer Nature Switzerland (2023)","DOI":"10.1007\/978-3-031-49803-9_10"},{"key":"8_CR26","doi-asserted-by":"publisher","first-page":"237","DOI":"10.1007\/978-3-031-49803-9_10","volume":"104","author":"L Schmitt","year":"2024","unstructured":"Schmitt, L., Kul, G.: Anti forensic measures and their impact on forensic investigations check for updates. Adversarial Multimedia Forensics 104, 237 (2024)","journal-title":"Adversarial Multimedia Forensics"},{"key":"8_CR27","doi-asserted-by":"publisher","unstructured":"Shahzad, F., Javed, A.R., Jalil, Z., Iqbal, F.: Cyber forensics with machine learning. In: Phung, D., Webb, G.I., Sammut, C. (eds.) Encyclopedia of Machine Learning and Data Science, pp.\u00a01\u20136. Springer US, New York, NY (2020). https:\/\/doi.org\/10.1007\/978-1-4899-7502-7_987-1","DOI":"10.1007\/978-1-4899-7502-7_987-1"},{"issue":"6","key":"8_CR28","first-page":"23","volume":"9","author":"JH Song","year":"2023","unstructured":"Song, J.H., Lee, H.S.: A design of timestamp manipulation detection method using storage performance in NTFs. J. Internet Things Converg. 9(6), 23\u201328 (2023)","journal-title":"J. Internet Things Converg."},{"key":"8_CR29","doi-asserted-by":"publisher","unstructured":"Stamm, M.C., Zhao, X.: Anti-forensic attacks using generative adversarial networks. In: Multimedia Forensics, pp. 109\u2013134. Springer (2022). https:\/\/doi.org\/10.1007\/978-981-16-6890-4_6","DOI":"10.1007\/978-981-16-6890-4_6"},{"key":"8_CR30","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2021.103002","volume":"63","author":"H Studiawan","year":"2021","unstructured":"Studiawan, H., Sohel, F.: Anomaly detection in a forensic timeline with deep autoencoders. J. Info. Secur. Appl. 63, 103002 (2021). https:\/\/doi.org\/10.1016\/j.jisa.2021.103002","journal-title":"J. Info. Secur. Appl."},{"key":"8_CR31","doi-asserted-by":"crossref","unstructured":"Vanini, C., Gruber, J., Hargreaves, C., Benenson, Z., Freiling, F., Breitinger, F.: Understanding strategies and challenges of timestamp tampering for improved digital forensic event reconstruction. In: Proceedings of the Digital Forensics Doctoral Symposium, pp.\u00a01\u20138 (2025)","DOI":"10.1145\/3712716.3712727"},{"key":"8_CR32","doi-asserted-by":"crossref","unstructured":"Vanini, C., Hargreaves, C., Breitinger, F.: Evaluating tamper resistance of digital forensic artifacts during event reconstruction. arXiv preprint (2024)","DOI":"10.1145\/3765627"}],"container-title":["Lecture Notes in Computer Science","Availability, Reliability and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-00635-6_8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T19:27:13Z","timestamp":1757359633000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-00635-6_8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783032006370","9783032006356"],"references-count":32,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-00635-6_8","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"9 August 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this paper.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ARES","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Availability, Reliability and Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ghent","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Belgium","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 August 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 August 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ares-12025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2025.ares-conference.eu","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}