Digital provenance - Interpretation, verification and corroboration

Digital Investigation

Volumn 2, Issue 1, 2005, Pages 45-49

  Turner, Philip ^a,b  

^a QINETIQ   (United Kingdom)

^b OXFORD BROOKES UNIVERSITY   (United Kingdom)

Author keywords

Computer forensics; Digital forensics; Evidence corroboration; Evidence interpretation; Provenance

Indexed keywords

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; DNA; HARD DISK STORAGE; INFORMATION ANALYSIS; LAWS AND LEGISLATION;

COMPUTER FORENSICS; DIGITAL FORENSICS; EVIDENCE CORROBORATION; EVIDENCE INTERPRETATION; PROVENANCE;

SECURITY OF DATA;

EID: 14544294808     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2005.01.002     Document Type: Article

References (7)

1. ® article ID: 12780. Time stamps change when copying from NTFS to FAT, Revision 2.0; May 6, 2003.
2. ® article ID: 299648. Description of NTFS date and time stamps for files and folders, Revision 2.0; July 3, 2003.
3. ® article ID: 234048. How Windows 2000 assigns, reserves and stores drive letters, Revision 1.0; November 21, 2003.
4. ® article ID: 51978. Order in which MS-DOS and Windows assign drive letters, Revision 2.1; September 28, 2004.
5. ®. Platform SDK: storage - editing drive letter assignments. 〈http://msdn.microsoft.com/library/default.asp?url=/ library/en-us/fileio/base/editing_drive_letter_assignments.〉.
6. ® Platform SDK: windows system information - time 〈http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ sysinfo/base/file_times.asp〉.
7. M.W. Stevens Unification of relative time frames Digital Investigation 1 3 2004