Covering Tracks

Once an attacker finishes his work, he wants to erase all tracks leading the investigators tracing back to him. This can be done using

1. Disable auditing.




2. Clearing logs.




3. Modifying logs, registry files.




4. Removing all files, folders created.