A digital forensics investigator is tasked with analyzing a compromised Mac computer recovered from a...

This scenario directly aligns with CHFI v11 objectives underAnti-Forensics Techniques, specifically techniques used to alter or destroy forensic artifacts to obstruct investigations. Log files on macOS systems—such as system logs, application logs, and security logs—are critical sources of evidence that help investigators reconstruct user activity, detect intrusions, and build event timelines.

When an attackeralters, deletes, or modifies log entries, the anti-forensic technique employed is classified asdata manipulation. CHFI v11 defines data manipulation as the intentional modification, deletion, or corruption of data or metadata to mislead investigators or erase traces of malicious activity. Log tampering is a classic example, as attackers often remove evidence of unauthorized access, privilege escalation, or persistence mechanisms.

Data encryption would make logs unreadable but not selectively altered or deleted. Data hiding involves concealing information in alternate locations (e.g., steganography or hidden files), while data obfuscation focuses on making data confusing but still present. In contrast, the complete deletion or alteration of log messages is a deliberate attempt to falsify or erase evidence. Therefore, consistent with CHFI v11 anti-forensics classifications,data manipulationis the correct and most accurate answer.