SECURITY RESEARCH July 9, 2025 8 min read

NullTrace: Advanced Anti-Forensics Driver

Production-grade KMDF driver for silent file system interception and data sinking operations

Silent Data Interception

NullTrace represents a significant advancement in anti-forensics technology, providing a production-grade Kernel-Mode Driver Framework (KMDF) solution for Windows file system interception. Unlike traditional forensics tools that aim to recover data, NullTrace operates silently to prevent data from reaching storage in the first place.

Core Capabilities

  • Silent Data Interception: Transparently captures writes to .log and .evtx files
  • Zero-Trace Operation: Returns success while discarding data
  • Ring Buffer Storage: 64KB secure buffer with overflow handling
  • Production Stability: Comprehensive error handling and fail-safe operation

Technical Architecture

┌─────────────────────────────────────┐ │ User Applications │ └──────────────┬──────────────────────┘ │ File I/O Operations ┌──────────────▼──────────────────────┐ │ NullTrace Filter │ │ ┌─────────────────────────────────┐ │ │ │ IRP Dispatch Routines │ │ │ │ • CREATE • WRITE • SET_INFO │ │ │ └─────────────────────────────────┘ │ │ ┌─────────────────────────────────┐ │ │ │ Ring Buffer (64KB) │ │ │ │ Non-Paged Pool Storage │ │ │ └─────────────────────────────────┘ │ └──────────────┬──────────────────────┘ │ Forward Non-Target Files ┌──────────────▼──────────────────────┐ │ File System Drivers │ │ (NTFS, FAT, etc.) │ └─────────────────────────────────────┘

Driver Components

The NullTrace architecture implements a sophisticated file system filter that sits between user applications and the underlying storage drivers. It intercepts IRP_MJ_CREATE, IRP_MJ_WRITE, and IRP_MJ_SET_INFORMATION operations, analyzing target filenames for specific extensions.

Anti-Detection Features

Transparent Operation

No visible impact on application behavior - operations appear completely normal to calling processes.

Silent Success

Returns STATUS_SUCCESS without forwarding blocked operations, maintaining application compatibility.

Memory Security

Secure buffer wiping using RtlSecureZeroMemory on driver unload prevents data recovery.

Minimal Footprint

Low resource usage with < 0.1% CPU overhead and 64KB memory footprint.

Implementation Details

System Requirements

Operating System: Windows 10/11 (x64) Driver Framework: KMDF 1.33 Development Kit: Windows Driver Kit (WDK) 10.0.22621+ Compiler: Visual Studio 2019/2022 with WDK integration Target Architecture: x64 only Privileges: Administrator rights for installation

Installation Process

NullTrace requires proper driver signing for production deployment. Development installations can use test signing mode. The driver is configured for the FSFilter Activity Monitor load order group with altitude 385200.

# Install driver package pnputil /add-driver Driver\inf\NullTrace.inf /install # Create service sc create NullTrace binPath= "%SystemRoot%\System32\drivers\NullTrace.sys" type= filesys start= demand # Configure dependencies sc config NullTrace depend= FltMgr # Start service sc start NullTrace

Performance Metrics

< 0.1% CPU Overhead
64KB Memory Usage
< 50μs I/O Latency
> 95% Throughput

Monitoring Interface

NullTrace provides a comprehensive IOCTL interface for real-time monitoring of driver activity. Statistics include bytes dropped, files intercepted, operations blocked, and ring buffer utilization metrics.

HANDLE hDevice = CreateFile(L"\\\\.\\NullTrace", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL); NULLTRACE_STATS stats; DWORD bytesReturned; DeviceIoControl(hDevice, IOCTL_NULLTRACE_STATS, NULL, 0, &stats, sizeof(stats), &bytesReturned, NULL); printf("Bytes Dropped: %llu\n", stats.TotalBytesDropped); printf("Writes Blocked: %llu\n", stats.TotalWritesBlocked);

Security Considerations

⚠️ Legal Disclaimer

This software is intended for legitimate security research, penetration testing, and authorized security assessments only. Users are responsible for compliance with applicable laws and regulations.

Operational Security

  • Driver Signing: Production deployments require valid code signing certificates
  • Access Control: IOCTL interface restricted to administrator privileges
  • Error Handling: Graceful degradation prevents system instability
  • Audit Trail: Optional statistics logging for operational awareness

Limitations

  • Only supports NTFS and FAT file systems
  • x64 Windows systems only
  • Unsigned drivers require test mode
  • Minimal but measurable I/O latency increase

Conclusion

NullTrace represents a sophisticated approach to anti-forensics technology, providing security researchers and penetration testers with a production-grade tool for advanced assessment scenarios. Its silent operation, comprehensive monitoring capabilities, and robust architecture make it an invaluable asset for legitimate security operations.

The driver's fail-safe design ensures system stability while providing powerful capabilities for authorized security assessments. With proper deployment and usage within legal boundaries, NullTrace advances the state of the art in defensive cybersecurity research.