Int 10: Anti-Forensics Detection - Mendeteksi Upaya Penghapusan Jejak

cd ~ && mkdir forensics-int10 && cd forensics-int10

# 1. Timestomping - memanipulasi timestamp
cd ~/forensics-int10
mkdir timestomp-test && cd timestomp-test

echo "Asli" > file-asli.txt
touch -t 202601010800 file-asli.txt  # Set ke 1 Jan 2026

echo "Palsu" > file-palsu.txt
touch -t 202401010800 file-palsu.txt  # Set ke 1 Jan 2024 (BACKDATED!)

echo "=== Analisis Timestomping ==*"
echo "File: file-palsu.txt"
stat file-palsu.txt | grep -E "(File:|Modify|Access|Change|Birth)"
echo ""
echo "⚠️ File dengan timestamp sebelum OS diinstall? (cek uptime)"
echo "⚠️ File dengan timestamp yang terlalu seragam?"
echo ""

# 2. Deteksi anomalii timestamp
python3 << 'PYEOF'
import os, stat as statmod, time

print("=== Anomaly Detection ==*")
files = [
    ("file-asli.txt", 1704067200),  # 2024
    ("file-palsu.txt", 1704067200), # 2024
]

now = time.time()
for fname, ts in files:
    age_days = (now - ts) / 86400
    print(f"{fname:20} → timestamp: {time.ctime(ts)}")
    print(f"  {' ':<20} → {age_days:.0f} hari yang lalu")
    if age_days < 1:
        print(f"  {' ':<20} → ⚠️ File BARU tapi timestamp KUNO? TIMESTOMPING!")
PYEOF

# 2. Log clearing detection
echo ""
echo "=== Log Clearing Detection ==*"
cat << 'LOGCLEAR'
Indikasi log clearing:
  [1] Event ID 1102 - Security log cleared (Windows)
  [2] Gap waktu di log - ada lompatan waktu mencurigakan
  [3] File log tiba-tiba kosong - size jadi 0 bytes
  [4] Log rotation tidak sesuai jadwal
  [5] auth.log di Linux dihapus atau di-truncate
LOGCLEAR