Swap files Anti-Forensics on Linux

Abstract

Swap file has potentially interesting and rich source of digital evidences. Password, cryptographic key, private data and sensitive data can be found in the swap file. With a simple technique such as string matching, digital evidences can be easily found and identified. There is minimal research on swap file anti-forensics. We found that most of swap file anti-forensics techniques are still vulnerable to live acquisition. So, we propose 2 swap file anti-forensic technique: inject live swap file and fake swap file. Inject live swap file is created by injecting(flooding) fake data to live swap file using a custom script. Fake swap is created by manipulate swap file header then filling swap file with fake artefacts of our choosing. We perform this technique before user begins his/her usual activities. We able to implement Inject live swap file technique but with disadvantage of private and sensitive data leak. Making fake swap file is relatively easy and without data leak. Although these two approaches do not solve the problem of live acquisition, it could confuse, mislead and wasting examiner's time.