Home Science Timestamp hiccups: Detecting manipulated filesystem timestamps on NTFS

Timestamp hiccups: Detecting manipulated filesystem timestamps on NTFS

0
1
2,149

Redundant capacity in filesystem timestamps is recently proposed in the literature as an effective means for information hiding and data leakage. Here, the authors evaluate the steganographic capabilities of such channels and propose techniques to aid digital forensics investigation towards identifying and detecting manipulated filesystem timestamps. Their findings indicate that different storage media and interfaces exhibit different timestamp creation patterns. Such differences can be utilised to characterise file source media and increase the analysis capabilities of the incident response process.

hiccups
Load More Related Articles
Load More In Science
Comments are closed.