Using the object ID index as an investigative approach for NTFS file systems

Nordvik, Rune; Toolan, Fergus; Axelsson, Stefán

doi:10.1016/j.diin.2019.01.013

Cited by 6 publications

(2 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• Data Heterogeneity: The current tools are incapable of integrating a large volume of data heterogeneity; even though some of these tools have the ability, to some extent, to extract complex data, such as unstructured data, they still cannot address the issue of providing a complete understanding of evidence data without cognitive overload (Chabot, et al, 2015). Arguably, these tools do not support features that would integrate complex data of different formats automatically (Nordvik, Toolan and Axelsson, 2019). Moreover, the absence of data automation leads to the overloading of digital investigators when they attempt to handle and investigate complex data heterogeneity.…”

Section: Table 1: a Comprehensive Evaluation Of Digital Forensics Too...mentioning

confidence: 99%

A Unified Forensics Analysis Approach to Digital Investigation

Alshumrani

Clarke

Ghita

2023

iccws

View full text Add to dashboard Cite

Digital forensics is now essential in addressing cybercrime and cyber-enabled crime but potentially it can have a role in almost every other type of crime. Given technology's continuous development and prevalence, the widespread adoption of technologies among society and the subsequent digital footprints that exist, the analysis of these technologies can help support investigations. The abundance of interconnected technologies and telecommunication platforms has significantly changed the nature of digital evidence. Subsequently, the nature and characteristics of digital forensic cases involve an enormous volume of data heterogeneity, scattered across multiple evidence sources, technologies, applications, and services. It is indisputable that the outspread and connections between existing technologies have raised the need to integrate, harmonise, unify and correlate evidence across data sources in an automated fashion. Unfortunately, the current state of the art in digital forensics leads to siloed approaches focussed upon specific technologies or support of a particular part of digital investigation. Due to this shortcoming, the digital investigator examines each data source independently, trawls through interconnected data across various sources, and often has to conduct data correlation manually, thus restricting the digital investigator’s ability to answer high-level questions in a timely manner with a low cognitive load. Therefore, this research paper investigates the limitations of the current state of the art in the digital forensics discipline and categorises common investigation crimes with the necessary corresponding digital analyses to define the characteristics of the next-generation approach. Based on these observations, it discusses the future capabilities of the next-generation unified forensics analysis tool (U-FAT), with a workflow example that illustrates data unification, correlation and visualisation processes within the proposed method.

show abstract

Section: Table 1: a Comprehensive Evaluation Of Digital Forensics Too...mentioning

confidence: 99%

A Unified Forensics Analysis Approach to Digital Investigation

Alshumrani

Clarke

Ghita

2023

iccws

View full text Add to dashboard Cite

show abstract

“…The file system in the employee appraisal research uses NTFS (New Technology File System). NTFS is very good for digital forensic analysis with extensive application support [5,6].…”

Section: Introductionmentioning

confidence: 99%

Digital Forensic InnoDB Database Engine for Employee Performance Appraisal Application

2019

View full text Add to dashboard Cite

Data is something that can be manipulated by irresponsible people and causing fraud. The use of log files, data theft, unauthorized person, and infiltration are things that should be prevented before the problem occurs. The authenticity of application data that evaluates the performance of company employees is very crucial. This paper will explain how to maintain the company’s big data as a valid standard service to assess employee performance database, based on employee performance of MariaDB or MySQL 5.0.11 with InnoDB storage engine. The authenticity of data is required for decent digital evidence when sabotage occurs. Digital forensic analysis carried out serves to reveal past activities, record time and be able to recover deleted data in the InnoDB storage engine table. A comprehensive examination is carried out by looking at the internal and external aspects of the Relational Database Management System (RDBMS). The result of this research is in the form of forensic tables in the InnoDB engine before and after sabotage occurs.

show abstract

Research and Implementation of EXFAT File System Reconstruction Algorithm Based on Cluster Size Assumption and Computational Verification

Lu,

Peng

2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Using the object ID index as an investigative approach for NTFS file systems

Cited by 6 publications

References 4 publications

A Unified Forensics Analysis Approach to Digital Investigation

A Unified Forensics Analysis Approach to Digital Investigation

Digital Forensic InnoDB Database Engine for Employee Performance Appraisal Application

Research and Implementation of EXFAT File System Reconstruction Algorithm Based on Cluster Size Assumption and Computational Verification

Contact Info

Product

Resources

About