Global analysis of drive file times

5th International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2010

Volumn , Issue , 2010, Pages 97-108

  Rowe, Neil C ^a   Garfinkel, Simson L ^a  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

Author keywords

Clusters; Diurnal; Drive images; Forensics; Registry; Timestamps; Triage

Indexed keywords

DIURNAL; DRIVE FILE; FORENSIC ANALYSIS; GLOBAL ANALYSIS; GLOBAL METHODS; TIME STAMPS;

COMPUTER CRIME; DISKS (STRUCTURAL COMPONENTS); ELECTRONIC CRIME COUNTERMEASURES;

FORENSIC ENGINEERING;

EID: 77954909030     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SADFE.2010.21     Document Type: Conference Paper

References (13)

1. N. Rowe, "Measuring the effectiveness of honeypot counter-counterdeception," Proc. Hawaii International Conference on Systems Sciences, Koloa, Hawaii, January 2006.
2. S. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt, "Bringing science to digital forensics with standardized forensic corpora," Digital Investigation, Vol. 6, S2-S11, 2009.
3. S. Garfinkel, "Automating disk forensic processing with SleuthKit, XML and Python," Proc. Systematic Approaches to Digital Forensics Engineering, Oakland, CA, 2009.
4. J. Olsson, and M. Boldt, "Computer forensic timeline visualization tool.," Digital Investigation, Vol. 6, S78-S87, 2009.
5. K. Chow, F. Law, M. Kwan, and P. Lai, "The rules of time on NTFS file systems," Proc. 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, Washington, April 2007.
6. S. Garfinkel, A. Parker-Wood, D. Huynh, J. Cowan-Sharp, and J. Migletz, "A solution to the multi-user carved data ascription problem," draft, October 2009.
7. R. Refinetti, Circadian Physiology, 2nd Edition. Boca Raton, FL: CRC Press, 2005.
8. F. Buchholz and B. Tjaden, "A brief study of time," Digital Investigation, Vol. 4S, 531-542, 2007.
9. Y. Zhu, P. Gladyshev, and J. James, "Temporal analysis of Windows MRU registry keys," in G. Peterson and S. Shenoi (Eds.), Advances in Digital Forensics V, IFIP AICT 306, pp. 83-93, 2009.
10. B. Carrier and E. H. Spafford, "Automated digital evidence target definition using outlier analysis and existing evidence," Proc. Fifth Digital Forensic Research Workshop, 2005.
11. J. Douceur and W. Bolosky, "A large-scale study of file-system contents," Proc. SIGMETRICS '99, Atlanta, GA, 1999.
12. N. Agrawal, W. Bolosky, J. Douceur and J. Lorch, "A five-year study of file-system metadata," ACM Transactions on Storage, Vol. 3, No. 3, Article 9, October 2007.
13. S. Doraimani and A. Iamnitchi, "File grouping for scientific data management: lessons from experimenting with real traces," Proc. HPDC'08, Boston, MA, 2008.