white-papers-defeating-anti-forensics-in-contemporary-complex-threats.pdf

This paper analyzes contemporary anti-forensic techniques used by complex threats — specifically hidden encrypted storage implemented by bootkits and rootkits (e.g., TDL4/Olmarik, Olmasco, Rovnix/Carberp, ZeroAccess, Hodprot). It describes architecture and on-disk layouts of hidden file systems, kernel-mode protection hooks and encryption schemes, and presents a forensic countermeasure (a Hidden FS Reader tool) to recover concealed payloads and configuration data.