NTFS Data Tracker: Tracking file data history based on $LogFile

Oh, Junghoon; Lee, Sangjin; Hwang, Hyunuk

doi:10.1016/j.fsidi.2021.301309

상세 보기

NTFS Data Tracker: Tracking file data history based on $LogFile

Oh, Junghoon;
Lee, Sangjin;
Hwang, Hyunuk

Citations

WEB OF SCIENCE

5

Citations

SCOPUS

14

초록

The $L o g F i l e i s a f i l esy s t e mm e t a f i l e t ha t s t or es N T F S (N e w T ec hn o l o g y F i l e S y s t e m) t r an s a c t i o n d a t a . I t i s u se d t or es t or e t h e f i l esy s t e m t o i t s n or ma l s t a t e in t h ee v e n t o f a f i l esy s t e m er r or, s u c ha so n ec a u se d b y s u dd e n p o w er o u t a g es . T h e t r an s a c t i o n d a t a r ecor d e d in$ LogFile contain changes in the metadata of files and directories in the $M F T . B y ana l y z in g i t, a l l f i l eo p er a t i o n s p er f or m e d in t h e f i l esy s t e m d u r in g a s p ec i f i c p er i o d c anb e i d e n t i f i e d . E x i s t in g r ese a r c h o n t h e$ LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $L o g F i l e t o a c q u i r e d a t a l oc a t i o nin f or ma t i o n (d a t a r u n s) t ha t i s ini t ia l l y s t or e d a tt h e t im eo f f i l ecr e a t i o n, or t or eco n s t r u c t o n l y t h e f ina l l oc a t i o nin f or ma t i o n o f t h e d a t a . N or ese a r c h, h o w e v er, ha s b ee n co n d u c t e d t o d a t eo n t r a c k in g t h ee n t i r e hi s t or y o f c han g es in t h e f i l e d a t a . I n t hi s p a p er, w e d e v e l o p a t ec hni q u e t ha t r e p r o d u cesc han g es in t h e m e t a d a t a w i t hin t h e$ MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed. (c) 2021 Elsevier Ltd. All rights reserved.

키워드

NTFS; $LogFile; Data history

제목: NTFS Data Tracker: Tracking file data history based on $LogFile

저자: Oh, Junghoon; Lee, Sangjin; Hwang, Hyunuk

DOI: 10.1016/j.fsidi.2021.301309

발행일: 2021-12

유형: Article

저널명: Forensic Science International-digital Investigation

권: 39

언어: ENG

출판사: ELSEVIER SCI LTD

발행국가: 영국

ISSN: E 2666-2817
P 2666-2817