/anti-forensics

name: anti-forensics
description: |
  This skill should be used when the user mentions "log cleaning", "clear logs",
  "wipe logs", "timestomp", "timestamp manipulation", "metadata stripping",
  "exiftool", "mat2", "file wiping", "shred", "srm", "secure delete",
  "bleachbit", "memory clearing", "swap wipe", "bash history", "wtmp", "btmp",
  "lastlog", "auth.log", "journal", "journalctl", "forensic artifacts",
  "anti-forensics", "trace removal", "cover tracks", "clean up traces",
  "eliminate footprint", "shell history", "browser artifacts", "dns cache",
  "arp cache", "network artifacts", "filesystem artifacts", "recent files",
  "thumbnails", "memory forensics", "swap artifacts", "proc cleanup",
  "container forensics", "cleanup checklist", "post-op cleanup",
  "artifact minimization", "live forensics evasion", "volatile artifacts",
  or discusses eliminating evidence, minimizing forensic traces, or cleaning
  operational artifacts from systems during or after authorized engagements.
  Make sure to activate this skill even when the user doesn't explicitly say
  "anti-forensics" — any mention of cleaning traces, removing evidence,
  wiping artifacts, or post-operation cleanup should trigger this skill.
version: 2.0.0

Anti-Forensics

Systematic identification and elimination of forensic artifacts across logs, file metadata, filesystem traces, volatile memory, network state, shell history, and application caches. Covers the full artifact lifecycle: pre-operation minimization, in-operation hygiene, and post-operation cleanup.

Why This Matters

Every action on a system leaves traces. A forensic investigator reconstructs timelines from logs, login records, shell history, file metadata, memory dumps, and network artifacts. Anti-forensics is not about making evidence vanish — it's about understanding exactly what traces exist, which ones matter, and eliminating them selectively without creating new anomalies that scream "someone cleaned up here." The goal is plausible deniability or complete trace elimination, depending on the opsec profile.

Tool Routing by Category

| Category | Primary Tools | Target Artifacts | Reference | |----------|--------------|------------------|-----------| | Log manipulation | `sed`, `utmpdump`, `journalctl`, `auditctl` | auth.log, syslog, wtmp, btmp, lastlog, journal, audit.log | `references/log-manipulation.md` | | Metadata stripping | `exiftool`, `mat2`, `ffmpeg`, `qpdf` | EXIF, XMP, IPTC, PDF metadata, Office metadata, audio/video tags | `references/metadata-stripping.md` | | Secure file deletion | `shred`, `srm`, `dd`, `hdparm`, `nvme` | File content, free space, swap, SSD secure erase | `references/secure-deletion.md` | | Volatile artifacts | `swapon/off`, `sysctl`, `ip`, `iptables` | RAM caches, swap, /proc, /dev/shm, page cache | `references/memory-and-volatile.md` | | Shell & terminal history | `history`, `unset`, `shred`, `ln` | bash_history, zsh_history, python_history, mysql_history, psql_history, less, vim | `references/shell-history.md` | | Filesystem artifacts | `find`, `touch`, `debugfs`, `tune2fs` | timestamps, journals, thumbnails, recently-used, trash, MRU lists | `references/filesystem-artifacts.md` | | Network artifacts | `ip`, `arp`, `resolvectl`, `conntrack`, `ss` | ARP cache, DNS cache, routing table, connection tracking, firewall logs | `references/network-artifacts.md` | | Browser & application caches | `rm`, `find`, `sqlite3` | browser history, cookies, cache, download history, session data | `references/application-artifacts.md` |

Opsec Profile Integration

The opsec profile determines the depth and urgency of anti-forensics operations. Always check the active profile before starting cleanup.

node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" get

| Profile | Cleanup Scope | Timing | Approach | Checklist | |---------|--------------|--------|----------|-----------| | `loud` | None — lab/CTF environment | N/A | No cleanup needed | — | | `normal` | Selective — remove obvious tool traces | Post-operation | Remove command history, temp files, clear auth artifacts | `references/cleanup-checklists.md` section "Normal" | | `stealth` | Comprehensive — eliminate all recoverable traces | During + post-operation | Full log manipulation, metadata strip, secure delete, memory clear | `references/cleanup-checklists.md` section "Stealth" | | `paranoid` | Total — assume forensic imaging is imminent | Continuous + post-operation | Everything in stealth + journal tampering, swap wipe, filesystem journal clear, SSD secure erase | `references/cleanup-checklists.md` section "Paranoid" |

Methodology

Phase 1 — Pre-Operation Artifact Minimization

Before touching a target, configure the operator's own system to minimize artifact generation. This is cheaper than cleaning up later.

1. **Disable shell history recording** before starting (see `references/shell-history.md`) 2. **Mount sensitive work directories as tmpfs** so data never hits disk 3. **Configure browser for no-trace mode** if browser-based access is needed 4. **Set up encrypted scratch space** for any files that must be written to disk 5. **Disable core dumps**: `ulimit -c 0` 6. **Disable swap** if sufficient RAM: `sudo swapoff -a`

Phase 2 — In-Operation Hygiene

During active operations, maintain artifact discipline:

1. **Pipe output rather than writing files** — avoid creating temporary files where possible 2. **Use memory-backed storage** (`/dev/shm`, tmpfs mounts) for operational data 3. **Monitor your own footprint** — periodically check what traces you're leaving 4. **Avoid tools that create dot-files** in home directories (or clean them immediately) 5. **Use timestomped file operations** — if you must write files, backdate timestamps to blend with existing files

Phase 3 — Post-Operation Cleanup

Systematic elimination in priority order:

1. **Shell history** — highest priority, contains exact commands (see `references/shell-history.md`)