Day 174 — Building a Data Wiping Detection Engine in 24 Hours (ISEA Hackathon)

Detection Engine Dashboard

This weekend, I participated in a 24-hour ISEA Anti-Forensic Detection Hackathon.

We didn’t place.

But we built a working forensic prototype that detects intentional data wiping at the raw disk-image level.

This is a breakdown of what we built, what worked, and what didn’t.

The Problem

When attackers attempt to destroy evidence, they often:

• Overwrite sectors with 0x00
• Overwrite with 0xFF
• Use high-entropy random data
• Perform multi-pass overwrite patterns

Standard forensic analysis shows large regions of “empty” or “free” space.

But free space and wiped space are not the same.

We wanted to detect:
Evidence of intentional overwrite behavior.

Architecture Overview

The system pipeline:

1. Disk image uploaded
2. Hash computed (integrity assurance)
3. Raw stream reader processes image in 4KB blocks
4. Each block classified:

• ZERO
• FF
• RANDOM (entropy threshold)
• MULTI (pattern-based detection)
• NORMAL

5. Consecutive suspicious blocks aggregated into regions

6. Intent score calculated

7. JSON output generated

8. Dashboard visualizes suspicious regions

All logic is deterministic.

Get Jinay’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

No ML.
No black-box scoring.
Every decision is explainable.

Technical Core

Block Classification

Entropy-based detection for RANDOM blocks
Byte-frequency analysis for pattern detection
Threshold tuning to avoid flagging legitimate compressed regions

Region Aggregation

Instead of treating blocks independently, we merged contiguous suspicious blocks.

This reduced noise significantly and made intent scoring meaningful.

Intent Scoring

Score based on:

• Block continuity
• Entropy profile
• Pattern type
• Region size

Filtered small accidental anomalies.

What Worked

• Modular engine design under 24-hour constraint
• Streaming model avoided memory overload
• Region merging drastically improved clarity
• Dashboard clearly visualized wipe behavior

What Didn’t

• No large-scale wipe dataset for benchmarking
• No correlation with filesystem metadata (future improvement)
• Performance not optimized for multi-GB enterprise images yet

Key Insight

Attackers can delete files.

But they cannot easily hide overwrite patterns without cost.

Detection should focus on behavior at the physical layer — not just file metadata.

This hackathon reinforced something simple:

Anti-forensics leaves artifacts too.

Day 174 of 700.
We didn’t win.
But we built something real.

GitHub Link to Detection Engine Tool:

https://github.com/jynxora/ISEA_Hackathon_Anti-Forensic_Trace_Cleaner_Detection

#700DaysOfSkill