Disk Analysis of Rootkit forensics

The process of disk analysis is the process of extracting a disk image file or a physical consistent copy of a compromised computer into a set of unknown binaries, which contain malicious software that requires forensics, through a series of complex processes. And the rootkit is going to do exactly the opposite, destroying the forensics process; we have two strategies to do this, one is the scorched-earth strategy-flooding the system with a lot of garbage binary files, which allows forensics people to spend an expensive amount of time figuring out our malicious programs. Two is called the low-slow strategy, we bypass the detection tool so that we do not appear in these unknown binaries, this is a rootkit-respected strategy, but also more difficult.

Disk Analysis of Rootkit forensics