Covering Your Tracks

Question 1

Erase, Modify, Disable Evidence

Answer 1

• removing unneeded files or tools that were added to the victims machine, hiding resources in uncommon locations

Question 2

Clearing Log Files

Answer 2

• cleaning up traces of activities in various log files

* NOT usually done during a pen test

Question 3

Modifying Log Files

Answer 3

• log files are just text, can use timestomp to modify access time of file, change file ownership to original user
• NOT usually done during a pen test

Question 4

TimeStomp

Answer 4

• touch (linux, unix, OS X) - updates time to the current time
• ctime (linux, unix, OSX) - change time to a given date/time
• meterpreter has a built in tool