On the role of file system metadata in digital forensics

Digital Investigation

Volumn 1, Issue 4, 2004, Pages 298-309

  Buchholz, Florian ^a   Spafford, Eugene ^a  

^a Purdue University   (United States)

Author keywords

Audit data; Computer forensics; Digital forensics; File systems; Intrusion analysis

Indexed keywords

COMPUTER SOFTWARE; DATA ACQUISITION; DATA STORAGE EQUIPMENT; INFORMATION RETRIEVAL; PUBLIC POLICY; SOCIETIES AND INSTITUTIONS;

AUDIT DATA; COMPUTER FORENSICS; DIGITAL FORENSICS; FILE SYSTEMS; INTRUSION ANALYSIS;

METADATA;

EID: 10644245884     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2004.10.002     Document Type: Article

References (43)

1. Anderson James P. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co.; April 1980.
2. Buchholz Florian, Shields Clay. Providing process origin information to aid in network traceback. In: Proceedings of the 2002 USENIX annual technical conference. Monterey, CA; July 2002. CERIAS TR 2002-22.
3. Buchholz Florian, Shields Clay. Providing process origin information to aid in computer forensic investigations. Journal of Computer Security September 2004;12(5):753-76.
4. Buchholz Florian. Pervasive binding of labels to system processes (working title). PhD thesis, Purdue University, West Lafayette, IN, in preparation.
5. Caloyannides Michael A. Computer forensics and privacy. Norwood, MA: Artech House; 2001.
6. Card Rémy, Ts'o Theodore, Tweedie Stephen. Design and implementation of the second extended filesystem. In: Brokken Frank B, et al editors. Proceedings of the first Dutch international symposium on Linux; 1994.
7. Carrier Brian. Sleuthkit and autopsy forensic browser. 〈http://www.sleuthkit.org〉.
8. Carrier B, Shields C. A recursive session token protocol for use in computer forensics and TCP traceback. Proceedings of the IEEE infocomm 2002; June 2002.
9. Carrier Brian D, Spafford Eugene H. Defining event reconstruction of digital crime scenes. Journal of Forensic Sciences 2004;49(6):11. CERIAS TR 2004-37.
10. Casey Eoghan editor. Handbook of computer crime investigation. San Diego, CA: Academic Press; 2002.
11. Casey Eoghan. Digital evidence and computer crime. 2nd ed. San Diego, CA: Academic Press; 2004.
12. Clark Franklin, Diliberto Ken. Investigating computer crime. Boca Raton, FL: CRC Press; 1996.
13. Daley RC, Neumann PG. A general-purpose file system for secondary storage. In: Fall joint computer conference; 1965.
14. Denning Dorothy E, MacDoran Peter F. Location-based authentication: grounding Cyberspace for better security. In: Internet besieged: countering Cyberspace scofflaws. ACM Press/Addison-Wesley Publishing Co; 1998. p. 167-74.
15. Encase forensic software.〈http://www.guidancesoftware.com〉.
16. Farmer Dan, Venema Wietse. The coroner's toolkit. 〈http://www.porcupine.org〉.
17. Flack Chapman J, Atallah Mikhail. A toolkit for modeling and compressing audit data. Technical report, COAST, Purdue University; 1998. COAST TR 98-20.
18. Garfinkel S, Spafford G, Schwartz A. Practical Unix and Internet security. 3rd ed. O'Reilly; 2003.
19. Hagmann R. Reimplementing the cedar file system using logging and group commit. In: Proceedings of the eleventh ACM symposium on operating systems principles. ACM Press; 1987. p. 155-62.
20. IEEE Standard for Information Technology - Portable Operating System Interface (POSIX). 〈http://standards.ieee.org/catalog/olis/arch_posix.html〉.
21. Institute for Security Technology Studies. Law enforcement tools and technologies for investigating cyber attacks: a national needs assessment. Technical report, Dartmouth College; 2002.
22. Institute for Security Technology Studies. Law enforcement tools and technologies for investigating cyber attacks: gap analysis report. Technical report, Dartmouth College; February 2004.
23. Kim Gene H, Spafford Eugene H. The design and implementation of tripwire: a file system integrity checker. In: ACM conference on computer and communications security; 1994. p. 18-29.
24. King Samuel T, Chen Peter M. Backtracking intrusions. In: Proceedings of the nineteenth ACM symposium on operating systems principles. ACM Press; 2003. p. 223-36.
25. Kruse II Warren G, Heiser Jay G. Computer forensics: incident response essentials. Boston, MA: Addsion-Wesley; 2002.
26. Kuperman Benjamin A. A categorization of computer security monitoring systems and the impact on the design of audit sources. PhD thesis, Purdue University, West Lafayette, IN, 08; 2004. CERIAS TR 2004-26.
27. Leach Paul J, Salz Rich. Uuids and guids. 〈http://www.webdav.org/specs/draft-leach-uuids-guids-01.txt〉.
28. Microsoft Corporation. FAT: general overview of on-disk format. 〈http://www.microsoft.com/hwdev/download/hardware/fatgen103.pdf〉 1999.
29. Mohay G, Anderson A, Collie B, De Vel O, McKemmish R. Computer and intrusion forensics. Norwood, MA: Artech House; 2003.
30. Murphy Daniel L. A virtual memory distributed file system; 1989.
31. Pike Rob, Presotto Dave, Dorward Scan, Flandrena Bob, Thompson Ken, Trickey Howard, et al. Plan 9 from Bell Labs. Computing Systems Summer 1995;8(3):221-54.
32. Ritchie DM, Thompson K. The unix time-sharing system, Fourth ACM symposium on operating system principles. New York: Yorktown Heights; October 1973.
33. Rogers MK, Seigfried K. The future of computer forensics: a needs analysis survey. Computers & Security 2004;26.
34. Santry Douglas S, Feeley Michael J, Hutchinson Norman C, Veitch Alistair C, Carton Ross W, Ofir Jacob. Deciding when to forget in the elephant file system. In: Symposium on operating systems principles; 1999. p. 110-23.
35. Stevens WR. Advanced programming in the UNIX environment. Reading, MA: Addison-Wesley; 1993.
36. Sun Microsystems. Sunshield basic security module guide. 〈http://docs.sun.com/db/doc/802-5757〉.
37. The forensic toolit. 〈http://www.accessdata.com/Product04_Overview.htm〉.
38. The National Institute of Justice. Electronic crime needs assessment for state and local law enforcement. 〈http://www.ojp.usdoj.gov/nij/pubs-sum/186276.htm〉 April 2001.
39. Turing AM. On computable numbers, with an application to the entscheidungsproblem. In: David M, editor. Proceedings of London Mathematical Society Series 2, vol. 42. Hewlett, NY: Raven Press; 1937. p. 230-65. [Reprinted in The Undecidable, 1965].
40. Turing AM. Correction to: on computable numbers, with an application to the entscheidungsproblem. Proceedings of London Mathematical Society Series 2 1938;43:544-6.
41. Unix system manual pages. Finding files: find (1).
42. Venema Wietse. Tcp wrapper, a tool for network monitoring, access control, and for setting up booby traps. Proceedings of 1992 USENIX security symposium September; 1992.
43. Wilding Edward. Computer evidence: a forensics investigations handbook. London: Sweet & Maxwell; 1997.