作者: Jewan Bang , Byeongyeong Yoo , Sangjin Lee
DOI: 10.1016/J.DIIN.2010.12.001
关键词: File system 、 Database 、 Unix file types 、 File system fragmentation 、 Computer file 、 Computer science 、 File Control Block 、 Versioning file system 、 Fork (file system) 、 Stub file
摘要: Time information is an important factor in digital forensic investigations. The time of files obtained under the New Technology File System (NTFS) for Windows determined by creation, modification, access, and master file table (MFT) entry modification times can be changed user manipulations such as copy, move, change. characteristics changes attributes used to analyze certain behaviors related data transfer modification. This study analyzes change or folders resulting from different operating systems deduces through a procedure based on analysis results.