Analysis of changes in file time attributes with file manipulation

Jewan Bang; Byeongyeong Yoo; Sangjin Lee

doi:10.1016/j.diin.2010.12.001

Analysis of changes in file time attributes with file manipulation

Jewan Bang, Byeongyeong Yoo, Sangjin Lee

School of Cybersecurity

Research output: Contribution to journal › Article › peer-review

10 Citations (Scopus)

Abstract

Time information is an important factor in digital forensic investigations. The time information of files obtained under the New Technology File System (NTFS) for Windows is determined by the creation, modification, access, and master file table (MFT) entry modification times and can be changed by user manipulations such as copy, move, and change. The characteristics of changes in time attributes can be used to analyze certain user behaviors related to data transfer and modification. This study analyzes the change in time attributes of files or folders resulting from user manipulations under different Windows operating systems and deduces user behaviors through a procedure based on the analysis results.

Original language	English
Pages (from-to)	135-144
Number of pages	10
Journal	Digital Investigation
Volume	7
Issue number	3-4
DOIs	https://doi.org/10.1016/j.diin.2010.12.001
Publication status	Published - 2011 Apr

Keywords

Digital forensics
Filesystem
NTFS
Timestamp
Windows

ASJC Scopus subject areas

Pathology and Forensic Medicine
Information Systems
Computer Science Applications
Medical Laboratory Technology
Law

Access to Document

10.1016/j.diin.2010.12.001

Cite this

@article{9136387b65164c4b816c062a035826f7,

title = "Analysis of changes in file time attributes with file manipulation",

abstract = "Time information is an important factor in digital forensic investigations. The time information of files obtained under the New Technology File System (NTFS) for Windows is determined by the creation, modification, access, and master file table (MFT) entry modification times and can be changed by user manipulations such as copy, move, and change. The characteristics of changes in time attributes can be used to analyze certain user behaviors related to data transfer and modification. This study analyzes the change in time attributes of files or folders resulting from user manipulations under different Windows operating systems and deduces user behaviors through a procedure based on the analysis results.",

keywords = "Digital forensics, Filesystem, NTFS, Timestamp, Windows",

author = "Jewan Bang and Byeongyeong Yoo and Sangjin Lee",

note = "Funding Information: This research was supported by Bio R&D program through the National Research Foundation of Korea funded by the Ministry of Education, Science and Technology (20100020634).",

year = "2011",

month = apr,

doi = "10.1016/j.diin.2010.12.001",

language = "English",

volume = "7",

pages = "135--144",

journal = "Digital Investigation",

issn = "1742-2876",

publisher = "Elsevier Limited",

number = "3-4",

}

TY - JOUR

T1 - Analysis of changes in file time attributes with file manipulation

AU - Bang, Jewan

AU - Yoo, Byeongyeong

AU - Lee, Sangjin

N1 - Funding Information: This research was supported by Bio R&D program through the National Research Foundation of Korea funded by the Ministry of Education, Science and Technology (20100020634).

PY - 2011/4

Y1 - 2011/4

N2 - Time information is an important factor in digital forensic investigations. The time information of files obtained under the New Technology File System (NTFS) for Windows is determined by the creation, modification, access, and master file table (MFT) entry modification times and can be changed by user manipulations such as copy, move, and change. The characteristics of changes in time attributes can be used to analyze certain user behaviors related to data transfer and modification. This study analyzes the change in time attributes of files or folders resulting from user manipulations under different Windows operating systems and deduces user behaviors through a procedure based on the analysis results.

AB - Time information is an important factor in digital forensic investigations. The time information of files obtained under the New Technology File System (NTFS) for Windows is determined by the creation, modification, access, and master file table (MFT) entry modification times and can be changed by user manipulations such as copy, move, and change. The characteristics of changes in time attributes can be used to analyze certain user behaviors related to data transfer and modification. This study analyzes the change in time attributes of files or folders resulting from user manipulations under different Windows operating systems and deduces user behaviors through a procedure based on the analysis results.

KW - Digital forensics

KW - Filesystem

KW - NTFS

KW - Timestamp

KW - Windows

UR - http://www.scopus.com/inward/record.url?scp=79953853321&partnerID=8YFLogxK

U2 - 10.1016/j.diin.2010.12.001

DO - 10.1016/j.diin.2010.12.001

M3 - Article

AN - SCOPUS:79953853321

SN - 1742-2876

VL - 7

SP - 135

EP - 144

JO - Digital Investigation

JF - Digital Investigation

IS - 3-4

ER -

Analysis of changes in file time attributes with file manipulation

Abstract

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this