Evidence Cleanup & Anti-Forensics Assessment

After completing authorized penetration test activities, reason through evidence cleanup to restore target systems to their pre-test state.

**Why Cleanup Matters**
- What is the difference between a red team cleanup and hiding attacker tracks?
- What documentation should you maintain during an engagement to enable complete cleanup?
- What happens if cleanup is incomplete and a third party discovers your artifacts?

**Windows Artifact Removal**
- What event logs contain evidence of your activity and how do you clear specific event IDs?
- How do you remove scheduled tasks, services, and registry keys you created?
- How do you securely delete files you wrote to disk?
- What are prefetch files, shimcache, and amcache and what do they record?

**Linux Artifact Removal**
- Which log files capture your activity? (/var/log/auth.log, syslog, wtmp, lastlog, bash_history)
- How do you clean bash history without deleting the entire file?
- How do you remove cron jobs, SSH keys, and user accounts you created?
- What file system timestamps should you restore and how?

**Network Artifact Cleanup**
- What network connections remain open after you stop your tools?
- How do you verify no listeners are still running on the target?
- What DNS cache entries might expose your C2 infrastructure?

**Verification**
- How do you verify cleanup is complete before leaving an engagement?
- What is the minimum checklist before closing out a penetration test?

Output:
- Pre-cleanup documentation template
- Windows cleanup command checklist
- Linux cleanup command checklist
- Final verification checklist