Detailed Information

Cited 0 time in webofscience Cited 0 time in scopus
Metadata Downloads

NTFS Data Tracker: Tracking file data history based on $LogFile

Authors
Oh, JunghoonLee, SangjinHwang, Hyunuk
Issue Date
12월-2021
Publisher
ELSEVIER SCI LTD
Keywords
$LogFile; Data history; NTFS
Citation
FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION, v.39
Indexed
SCIE
SCOPUS
Journal Title
FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION
Volume
39
URI
https://scholar.korea.ac.kr/handle/2021.sw.korea/135585
DOI
10.1016/j.fsidi.2021.301309
ISSN
2666-2817
Abstract
The $LogFile is a file system metafile that stores NTFS (New Technology File System) transaction data. It is used to restore the file system to its normal state in the event of a file system error, such as one caused by sudden power outages. The transaction data recorded in $LogFile contain changes in the metadata of files and directories in the $MFT. By analyzing it, all file operations performed in the file system during a specific period can be identified. Existing research on the $LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $LogFile to acquire data location information (data runs) that is initially stored at the time of file creation, or to reconstruct only the final location information of the data. No research, however, has been conducted to date on tracking the entire history of changes in the file data. In this paper, we develop a technique that reproduces changes in the metadata within the $MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed. (c) 2021 Elsevier Ltd. All rights reserved.
Files in This Item
There are no files associated with this item.
Appears in
Collections
School of Cyber Security > Department of Information Security > 1. Journal Articles

qrcode

Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.

Related Researcher

Researcher LEE, SANG JIN photo

LEE, SANG JIN
정보보호학과
Read more

Altmetrics

Total Views & Downloads

BROWSE