An efficient technique for enhancing forensic capabilities of Ext2 file system

Digital Investigation

Volumn 4, Issue SUPPL., 2007, Pages 55-61

  Barik, Mridul Sankar ^a   Gupta, Gaurav ^b   Sinha, Shubhro ^c   Mishra, Alok ^c   Mazumdar, Chandan ^a  

^a JADAVPUR UNIVERSITY   (India)

^b KPMG   (Netherlands)

^c INDIAN INSTITUTE OF ENGINEERING SCIENCE AND TECHNOLOGY   (India)

Author keywords

Authentic date and time stamps (ADTS); Computer Frauds and Cyber Crimes (CFCC); date and time stamps (MAC DTS); Electronic documents; Ext2 file system; Loadable Kernel Module (LKM); Modification access and creation

Indexed keywords

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; ELECTRONIC DOCUMENT EXCHANGE; FILE ORGANIZATION;

DIGITAL DOCUMENTS; FILE SYSTEM; INTEGRITY; LOADABLE KERNEL MODULE (LKM);

SECURITY OF DATA;

EID: 34447620631     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2007.06.007     Document Type: Article

References (17)

1. Boyd C., and Forster P. Time and date issues in forensic computing: a case study. National Technical Assistance Centre, UK. Digit Investig 1 (2004) 18-23 [Elsevier]
2. Bovet Daniel P, Cesati Marco. Understanding the Linux kernel. 2nd ed. O'Reilly & Associates.
3. Bach M.J. The design of the UNIX operating system (1988), Prentice Hall of India
4. Card Rémy, Ts'o Theodore, Tweedie Stephen. Design and implementation of the second extended filesystem. In: Proceedings of the first Dutch international symposium on Linux, 1994. ISBN 90-367-0385-9. Available from: .
5. Encase® Forensic. Guidance software.
6. Farmer D., and Venema W. Forensic discovery (2004), Addison Wesley
7. Forensic examination of digital evidence: guide for law enforcement (April 2004), U.S. Department of Justice, Office of Justice Programs, National Institute of Justice
8. Hosmer Chet. Time lining computer evidence. WetStone Technologies. In: Information Technology Conference, IEEE; 1998. p. 109-12.
9. Hosmer C. Proving the integrity of digital evidence with time. President & CEO, WetStone Technologies, Inc. Int J Digit Evid 1 1 (Spring 2002)
10. Ilook Investigator©. Computer forensics software.
11. IBM's journaled filesystem.
12. Linux audit-subsystem design documentation for kernel 2.6 version 0.1. Available from:.
13. Russell Chris. Analysis of a secure time stamp device. In: GSEC practical assignment version 1.2f, for GIAC certification in security essentials October 17, 2001. SANS Institute; 2001.
14. Red Hat's new journaling file system: Ext3.
15. Reiser file system.
16. Weil M.C. Dynamic time & date stamp analysis. Computer Forensic Examiner, Department of Defense Computer Forensics. Int J Digit Evid 1 2 (Summer 2002)
17. XFS: A high-performance journaling filesystem.