Systems and methods for countering removal of digital forensics information by malicious software

A system for preventing anti-forensics actions, the system comprising:

• a hardware processor configured to:
• monitor, from a plurality of objects on a computing device, a plurality of suspicious objects for a threshold period of time;
• identify a subset of the suspicious objects that have not performed, over the threshold period of time, actions that degrade a performance of the computing device or compromise user privacy on the computing device;
• determine that the subset of the suspicious objects are not suspicious;
• cease monitoring of the subset;
• identify a suspicious object from the plurality of suspicious objects not in the subset;
• monitor actions performed by the suspicious object, wherein the actions comprise commands and requests originating from the suspicious object;
• intercept a first command by the suspicious object to create and/or modify a digital artifact on the computing device;
• subsequent to intercepting the first command, intercept a second command by the suspicious object to delete at least one of the suspicious object and the digital artifact;
• in response to intercepting both the first command to create and/or modify the digital artifact and the second command to delete at least one of the suspicious object and the digital artifact:
• block the second command;
• and
• store the suspicious object and the digital artifact in a digital repository.

A non-transitory computer readable medium storing thereon computer executable instructions for preventing anti-forensics actions, comprising instructions for:

• monitoring, from a plurality of objects on a computing device, a plurality of suspicious objects for a threshold period of time;
• identifying a subset of the suspicious objects that have not performed, over the threshold period of time, actions that degrade a performance of the computing device or compromise user privacy on the computing device;
• determining that the subset of the suspicious objects are not suspicious;
• ceasing monitoring of the subset;
• identifying a suspicious object from the plurality of suspicious objects not in the subset;
• monitoring actions performed by the suspicious object, wherein the actions comprise commands and requests originating from the suspicious object;
• intercepting a first command by the suspicious object to create and/or modify a digital artifact on the computing device;
• subsequent to intercepting the first command, intercepting a second command by the suspicious object to delete at least one of the suspicious object and the digital artifact;
• in response to intercepting both the first command to create and/or modify the digital artifact and the second command to delete at least one of the suspicious object and the digital artifact:
• blocking the second command;
• and
• storing the suspicious object and the digital artifact in a digital repository.