Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
Source abstract
Abstract
In this article, we propose a creation order reconstruction method of deleted files for the FAT32 file system with Windows operating systems. Creation order of files is established using a correlation between storage locations of the files and their directory entry locations. This method can be utilized to derive the creation-time bound of files recovered without the creation-time information. In this article, we first examine the file allocation behavior of Windows FAT32 file system. Next, based on the examined behavior, we propose a novel method that finds the creation order of deleted files after being recovered without the creation-time information. Due to complex behaviors of Windows FAT32 file system, the method may find multiple creation orders although the actual creation order is unique. In experiments with a commercial device, we confirm that the actual creation order of each recovered file belongs to one of the creation orders found by the method.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Digital and Cyber Forensics · Advanced Data Storage Technologies · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science, Dongduk Women’s University, Seoul 02748, Korea
Department of Informatics, Gyeongsang National University, Jinju 52828, Korea
Department of Computer Science and Engineering, Korea University, Seoul 02841, Korea
Funding
National Research Foundation of Korea
References (29)
Show source-provided references
1. Lanh, T.V., Chong, K.S., Emmanuel, S., and Kankanhalli, M.S. (2007, January 2–5). A Survey on Digital Camera Image Forensic Methods. Proceedings of the IEEE International Conference on Multimedia and Expo (ICME), Beijing, China.
2. Video Content Authentication Techniques: A Comprehensive Survey10.1007/s00530-017-0538-9 ↗
3. A Survey on Multimedia File Carving10.5121/ijcses.2015.6603 ↗
4. A Survey of Digital Watermarking Techniques for Multimedia Data
5. Digital video tampering detection: An overview of passive techniques10.1016/j.diin.2016.06.003 ↗
6. Integrity Verification Scheme of Video Contents in Surveillance Cameras for Digital Forensic Investigations10.1587/transinf.2014MUL0001 ↗
7. Integrity Verification of the Ordered Data Structures in Manipulated Video Content10.1016/j.diin.2016.06.001 ↗
8. Sim, S.G., Kim, E.S., Kim, D.S., Lee, S.W., and Lee, W.Y. (2019). Apparatus and Method for Verifying the Integrity of Video File. (10,382,835), U.S. Patent.
9. Poisel, R., and Tjoa, S. (2013, January 2–6). A Comprehensive Literature Review of File Carving. Proceedings of the International Conference on Availability, Reliability and Security (ARES), Regensburg, Germany.10.1109/ARES.2013.62 ↗
10. The evaluation of file carving10.1109/MSP.2008.931081 ↗
11. Aronson, L., and van den Bos, J. (2011, January 18–22). Towards an Engineering Approach to File Carver Construction. Proceedings of the Annual Computer Software and Applications Conference (COMPSAC), Munich, Germany.10.1109/COMPSACW.2011.68 ↗
12. Classification and Recovery of Fragmented Multimedia Files Using the File Carving Approach10.4018/jmcmc.2013070104 ↗
13. Richard, G.G., and Roussev, V. (2005, January 17–19). Scalpel: A Frugal, High Performance File Carver. Proceedings of the Digital Forensic Research Workshop(DFRWS), New Orleans, LA, USA.
14. Carving contiguous and fragmented files with fast object validation10.1016/j.diin.2007.06.017 ↗
15. A study on multimedia file carving method10.1007/s11042-010-0704-y ↗
16. Frame-based recovery of corrupted video files using video codec specifications
17. Alghafli, K., and Martin, T. (2016, January 5–7). Identification and Recovery of Video Fragments for Forensic File Carving. Proceedings of the International Conference for Internet Technology and Secured Transactions (ICITST), Barcelona, Spain.10.1109/ICITST.2016.7856710 ↗
18. A security carving approach for AVI video based on frame size and index10.1007/s11042-016-3716-4 ↗
19. A Survey on Forensic Event Reconstruction Systems
20. A Framework for Post-Event Timeline Reconstruction Using Neural Networks10.1016/j.diin.2007.11.001 ↗
21. An Automated timeline reconstruction apporach for digital forensic investigations10.1016/j.diin.2012.05.006 ↗
22. Kang, J., Lee, S., and Lee, H. (2013, January 12–14). A Digital Forensic Framework for Automated User Activity Reconstruction. Proceedings of the International Conference on Information Security Practice and Experience (ISPEC), Lanzhou, China.10.1007/978-3-642-38033-4_19 ↗
23. A Complete Formalized Knowledge Representation Model for Advanced Digital Forensic Timeline Analysis
24. Tse, W.H.K. (2011). Forensic Analysis Using FAT32 Cluster Allocation Patterns. [Master’s Thesis, The University of Hong Kong].
25. The Linux FAT32 allocator and file creation order reconstruction10.1016/j.diin.2014.06.008 ↗
26. Comments on The Linux FAT32 Allocator and File Creation Order Reconstruction10.1016/j.diin.2015.09.003 ↗
27. Willassen, S.Y. (2008, January 4–7). Finding Evidence of Antedating in Digital Investigation. Proceedings of the International Conference on Availability, Reliability and Security (ARES), Barcelona, Spain.10.1109/ARES.2008.149 ↗
28. Carrier, B. (2005). File System Forensic Analysis, Addison-Wesley.
29. Microsoft Corporation (2000, December 06). Microsoft Extensible Firmware Initiative FAT32 File System Specification. Available online: http://msdn.microsoft.com/en-us/library/windows/hardware/gg463080.aspx.