Manual Deletion: In case the AM has physical access to the TS before the DFA intervention, he can manually
delete the unwanted traces produced by the automation. In particular, he could wipe any files belonging to the automation,
remove any suspicious entries in application logs and clean-up system records. The AM could use OS-specific tools
to accomplish this task. For example, the shred tool [39] on *NIX systems and the SDelete software [40] on Windows
systems. However, this approach has two disadvantages. First, some protected resources such as filesystem structures
cannot be accessed at system runtime. Second, the use of wiping tools may recursively determine the generation of
other unwanted evidence. A better approach is to indirectly access the system storage, for example, by means of a live
Linux distribution such as the Deft [41] suite. In this way, the AM can access and modify system protected resources.
Since the entire software environment used to accomplish this task is maintained in memory, with the due precautions, this approach produces no unwanted traces on the TS.