SoK: Understanding Anti-Forensics Concepts and Research Practices Across Forensic Subdomains

2026-04-07

AI Summary

This study addresses the fragmented understanding of anti-forensics in digital forensics, hindered by ambiguous definitions, inconsistent applications, and ethical controversies. To establish a coherent foundation, this work presents the first cross-subfield Systematization of Knowledge (SoK), integrating qualitative coding and quantitative analysis of 123 scholarly publications. The review clarifies the taxonomy, distribution patterns, and prevailing research paradigms of anti-forensic techniques. It further elucidates domain-specific application modalities, underlying motivations, and associated ethical challenges. Building on these insights, the paper proposes a conceptually rigorous and ethically grounded framework for anti-forensics research, thereby enabling more systematic and responsible scholarly inquiry in this critical area.

Abstract

Anti-forensics includes a growing set of techniques designed to obstruct forensic analysis. While cybercriminals increasingly rely on these methods, they also help researchers identify and remedy weaknesses in forensic tools, advancing the overall robustness of digital forensics. Despite repeated efforts to define it, anti-forensics remains vague and inconsistent in its use. It also poses ethical challenges regarding the appropriateness of research practices and the legitimacy of the field itself. This article presents a systematic analysis of 123 publications on anti-forensics, combining qualitative and quantitative methods. We quantify the main techniques and attack vectors, examine their occurrence in different digital forensic subdomains, and identify typical research methods, motivations, and applications. This work also discusses what these findings mean for future research and proposes directions for building a more coherent and ethically grounded understanding of anti-forensics.

Problem

• anti-forensics
• digital forensics
• research ethics
• conceptual clarity
• forensic subdomains

Innovation

• anti-forensics
• systematic literature review
• digital forensics
• research ethics
• attack vectors