# Forensia | Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase

**URL:** <https://onehack.st/t/forensia-anti-forensics-tool-for-red-teamers-used-for-erasing-footprints-in-the-post-exploitation-phase/249595>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [June 23, 2023, 9:30am UTC](https://onehack.st/t/forensia-anti-forensics-tool-for-red-teamers-used-for-erasing-footprints-in-the-post-exploitation-phase/249595 "2023-06-23T09:30:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [June 23, 2023, 9:30am UTC](https://onehack.st/t/forensia-anti-forensics-tool-for-red-teamers-used-for-erasing-footprints-in-the-post-exploitation-phase/249595/1 "2023-06-23T09:30:09Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/6/467f255c738f0a59cd45f2d868e68ddf8029f50c.png)

# Forensia

**Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase.**

Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams.

## Capabilities

- Unloading Sysmon Driver.
- Gutmann Method File Shredding.
- USNJrnl Disabler.
- Prefetch Disabler.
- Log Eraser and Event log Disabler.
- User Assist Update Time Disabler.
- Access Time Disabler.
- Clear Recent Items
- Clear Shim Cache
- Clear RecentFileCache
- Clear ShellBag
- Delete Windows Defender Quarantine Files
- File Melting Capabilities.

[![Screenshot](https://github.com/PaulNorman01/Forensia/raw/main/forensia.png)](https://github.com/PaulNorman01/Forensia/blob/main/forensia.png)

## Important Update

Added:

- Clear Recent Items
- Clear Shim Cache
- Clear RecentFileCache
- Clear ShellBag
- Clear Quanatine Files

## TODO

- USNJRnl Execution On All Disk Drives.
- Unallocated Space ReWriting.
- A Bit of Polishing.

## Credits

> **[GitHub - Naranbataar/Corrupt: Simple and efficient file shredding](https://github.com/Naranbataar/Corrupt)**
>
> Simple and efficient file shredding

> **[GitHub - LloydLabs/delete-self-poc: A way to delete a locked file, or current running...](https://github.com/LloydLabs/delete-self-poc)**
>
> A way to delete a locked file, or current running executable, on disk.

> <https://github.com/OsandaMalith/WindowsInternals/blob/master/Unload_Minifilter.c>

> **[User Jonathan Leffler](https://stackoverflow.com/users/15168/jonathan-leffler)**
>
> Stack Overflow | The World’s Largest Online Community for Developers

> **[GitHub - GiovanniDicanio/WinReg: Convenient high-level C++ wrapper around the...](https://github.com/GiovanniDicanio/WinReg)**
>
> Convenient high-level C++ wrapper around the Windows Registry API

## GitHub:

> **[GitHub - PaulNorman01/Forensia: Anti Forensics Tool For Red Teamers, Used For...](https://github.com/PaulNorman01/Forensia)**
>
> Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.