Countering Forensics Software by Baiting Them - Android Anti-Forensic Techniques

Explore advanced anti-forensic techniques in this DEF CON 33 conference talk that challenges fundamental assumptions in mobile forensic investigations. Learn how sophisticated countermeasures embedded within Android devices can silently compromise evidence integrity and undermine traditional extraction methodologies. Discover the critical blind spot in Android logical extraction workflows where forensic tools, despite successfully gaining device access, remain vulnerable to stealthy second-layer defenses that can manipulate or destroy data post-access. Examine real-world test results demonstrating how adversarially modified environments can exploit the common assumption that target devices function as expected, revealing significant gaps in forensic reliability. Gain insights into how these anti-forensic techniques operate below the radar of current investigative tools and understand the implications for digital forensics professionals who rely on established extraction procedures.