Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
- Authors
- Lee, Wan Yeon; Kim, Kyong Hoon; Lee, Heejo
- Issue Date
- 12월-2019
- Publisher
- MDPI
- Keywords
- creation-time; FAT32 file system; file allocation behavior; order reconstruction; recovered file
- Citation
- APPLIED SCIENCES-BASEL, v.9, no.24
- Indexed
- SCIE
SCOPUS
- Journal Title
- APPLIED SCIENCES-BASEL
- Volume
- 9
- Number
- 24
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/61433
- DOI
- 10.3390/app9245522
- ISSN
- 2076-3417
- Abstract
- In this article, we propose a creation order reconstruction method of deleted files for the FAT32 file system with Windows operating systems. Creation order of files is established using a correlation between storage locations of the files and their directory entry locations. This method can be utilized to derive the creation-time bound of files recovered without the creation-time information. In this article, we first examine the file allocation behavior of Windows FAT32 file system. Next, based on the examined behavior, we propose a novel method that finds the creation order of deleted files after being recovered without the creation-time information. Due to complex behaviors of Windows FAT32 file system, the method may find multiple creation orders although the actual creation order is unique. In experiments with a commercial device, we confirm that the actual creation order of each recovered file belongs to one of the creation orders found by the method.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - Graduate School > Department of Computer Science and Engineering > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.