NTFS Research Articles

Problem solved: A reliable, deterministic method for JPEG fragmentation point detection

Recovery of deleted JPEG files is severely hindered by fragmentation. Current state-of-the-art JPEG file recovery methods rely on content-based approaches. That is, they consider whether a sequence of bytes translates into a consistent picture based on its visual representation, treating fragmentation indirectly, with varying results. In contrast, in this paper, we focus on identifying fragmentation points on bit-level, that is, identifying whether a candidate next block of bytes is a valid extension of the current JPEG. Concretely, we extend, implement and exhaustively test a novel deterministic algorithm for finding fragmentation points in JPEGs. Even in the worst case scenario, our implementation finds over 99.4 % of fragmentation points within 4 kB – i.e., within the standard block size on NTFS and exFAT file systems. As such, we consider the problem of detecting JPEG fragmentation points solved.

Comparison of EXT4 and NTFS filesystem performance

The aim of this article is to compare the two most popular and competing file systems – EXT4 and NTFS in Ubutnu with the use of SSD disk.. At the beginning of this article, a critical description of the literature was made, explaining the purposefulness of the research undertaken. Additionally, the basics of the operation of both discussed file systems are explained. The research consisted of copying files between two partitions and measuring the time of this operation using a specially developed system shell script in the bash language. The conducted research has shown that the EXT4 system is more effective than the NTFS system.

Alternate Data Stream Attack Framework to Perform Stealth Attacks on Active Directory Hosts

Microsoft’s file system, NTFS, is the most utilised file system by Windows OS versions XP, Vista, 7, and 10. These systems have a little-known file attribute feature known as alternate data streams (ADS) which allows each file in the NTFS file system to have multiple data streams. ADS cannot be removed from the NTFS operating systems. However, the presence of ADS is not inevitably an issue in the OS or file system. Valid instances can be found on systems if scanned and might be valid. Windows OS does not have any in-built tools or applications to determine and remove the presence of existing ADS. This research presents ADSA or alternate data stream attack framework to exploit the alternate data streams and perform cyberattacks on Microsoft operating systems. This research discusses the process of creating and searching alternate data streams with a standard file and an executable binary. The authors executed ADS-hidden executable binary in the ADS. The authors present methods to detect and perform a clean-up by deleting the alternate data stream.

Forensic Recovery of File System Metadata for Digital Forensic Investigation

File system forensics is one of the most important elements in digital forensic investigations. To date, various file system forensic methods, such as analysis of tree structure and the recovery of deleted file data, have been studied. Among these file system forensic methods, the recovery of file system metadata is a key technique that makes digital forensic investigations possible by recovering metadata when it is not possible to obtain metadata in a regular manner because the file system structure is damaged due to an accident/disaster or cyber terrorism. Previous studies mainly focused on recovering record or entry data, which are the basic units of metadata, using carving techniques via a fixed values or values capable of range prediction at the beginning of the data. However, no studies have been conducted on metadata without such fixed values or values capable of range prediction. $LogFile, which is a metadata file of the New Technology File System (NTFS) that is one of the most used file systems at present, contains very important metadata that provide a history of all file system operations during a specific period. However, since there is no fixed value or a value capable of range prediction at the start position of the record, which is the basic unit of $LogFile, there have been no studies on recovery using record units, and only recovery by file and page have been possible. If the file header or page header of $LogFile is damaged, existing recovery methods cannot properly recover the metadata; in such cases, a record-level recovery method is required to recover the metadata. In this context, we investigated the mechanisms of record storage through a detailed analysis of the $LogFile structure and proposed a recovery method for records without fixed values. Our proposed method was implemented as a tool and verified through comparative experiments with existing forensic tools that recover $LogFile data. The experimental results showed that the proposed recovery method was able recover all the data that existing tools are unable to recover in situations where the $LogFile data were damaged. The implemented tools are released free of charge to contribute digital forensic community. Finally, we explained what important role $LogFile played in solving real-world cases and confirm the importance of recovering $LogFile data in situations where file systems may be damaged due to accidents and disasters.

NTFS Data Tracker: Tracking file data history based on $LogFile

The $LogFile is a file system metafile that stores NTFS (New Technology File System) transaction data. It is used to restore the file system to its normal state in the event of a file system error, such as one caused by sudden power outages. The transaction data recorded in $LogFile contain changes in the metadata of files and directories in the $MFT. By analyzing it, all file operations performed in the file system during a specific period can be identified. Existing research on the $LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $LogFile to acquire data location information (data runs) that is initially stored at the time of file creation, or to reconstruct only the final location information of the data. No research, however, has been conducted to date on tracking the entire history of changes in the file data. In this paper, we develop a technique that reproduces changes in the metadata within the $MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed.

Forensic analysis of anti-forensic file-wiping tools on Windows.

This paper presents forensic analysis of anti-forensic file-wiping tools on the Windows platform. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. We also analyzed Registry keys and .lnk files to collect the evidence. Our experiments used four file-wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them. We also found that the contents of resident and non-resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.

Comparison of data recovery techniques on master file table between Aho-Corasick and logical data recovery based on efficiency

Data recovery is one of the tools used to obtain digital forensics from various storage media that rely entirely on the file system used to organize files in these media. In this paper, two of the latest techniques of file recovery from file system (new technology file system (NTFS)) logical data recovery, Aho-Corasick data recovery were studied, examined and a practical comparison was made between these two techniques according to the speed and accuracy factors using three global datasets. It was noted that all previous studies in this field completely ignored the time criterion despite the importance of this standard. On the other hand, algorithms developed with other algorithms were not compared. The proposed comparison of this paper aims to detect the weaknesses and strength of both algorithms to develop a new algorithm that is more accurate and faster than both algorithms. The paper concluded that the logical algorithm was superior to the Aho-Corasick algorithm according to the speed criterion, whereas the algorithms gave the same results according to the accuracy criterion. The paper leads to a set of suggestions for future research aimed at achieving a highly efficient and high-speed data recovery algorithm such as the file-carving algorithm.

Problems of personal data and information protection in corporate computer networks

The article discusses the problems of personal data and information protection from intruders as well as methods of authentication and identification in corporate networks. Various methods of authentication and identification in computer networks are presented. Their comparative analysis is carried out, the features and disadvantages in various areas of use are highlighted, risks and possible damage from violation of data confidentiality are analyzed. The magnitude of violations of confidentiality, availability and integrity of information is growing every year, at the same time, the caused damage is growing. This situation makes it necessary for information security specialists to analyze all the risks of illegal access to information more and more thoroughly, and then resort to the introduction of modern means authentication, use new encryption methods, increasingly generate new passwords to access the system. Today, there are many ways and methods of authentication, but the specific of their application depends on the location of the information storage and its value. Meanwhile, authentication methods are not perfect protection methods, they are also vulnerable and here the situation is mostly depends on the skills of the attackers. In addition, the article discusses the problems of information security threats to flash drives, analyzes the FAT32 and NTFS file systems of flash drives as well as their vulnerabilities to malicious programs. The features of the algorithm of virus action on flash drives are highlighted. Today, there are many ways and methods of flash drives protection, but the specifics of their use depends on the location of the information storage and its value.

De-Wipimization: Detection of data wiping traces for investigating NTFS file system

Data wiping is used to securely delete securely unwanted files. However, the misuse of data wiping can destroy pieces of evidence to be spoiled in a digital forensic investigation. To cope with the misuse of data wiping, we proposed an anti-anti-forensic method based on NTFS transaction features and a machine learning algorithm. This method allows investigators to obtain information regarding ‘which files are wiped’ and ‘which data wiping tools and data sanitization standards used’. In this study, we achieved good identification of data wiping traces in the NTFS file system. Leveraging the efficiency of machine learning models, our method effectively recognizes wiped partitions and files in the NTFS file system and identifies tools used in data sanitization.

Specialization of Microcomputers for Targeted Use

Since 2015, microcomputers have appeared in the information environment, which are a compact system unit with minimal functionality without peripherals. The article published the results of the analysis of the use of 6 different microcomputers in various fields of activity. The purpose of the study is to determine the limiting factors affecting the efficiency of the targeted use of microcomputers. It has been established that for scientific and educational presentations, office and trading activities, it is currently advisable to use fanless microcomputers with a perforated case and an internal WiFi antenna, at least 4 GB of operational and 64 GB of permanent memory, and a microSD (TF) memory card slot, at least 128 GB, NTFS file system), Intel HD Graphics, USB3.0 and HDMI interfaces. Based on comparative experiments, methodological recommendations were created on optimizing the configuration of the hardware-software environment of microcomputers in stationary and mobile conditions. The problems of major updates to Windows 10, as well as the compatibility of Microsoft Store software and third-party manufacturers, are analyzed. It is recommended to specialize individual microcomputers for working with 32-bit applications; accounting and cryptographic programs; as well as conducting presentations with their video. Options for optimal configuration of the Start menu of the Windows 10 desktop are suggested. It is concluded that specialization in the hardware-software configuration of modern microcomputers allows you to increase the efficiency of using single devices and their paired systems in accordance with BYOD (Bring Your Own Device).

Live forensics method for acquisition on the Solid State Drive (SSD) NVMe TRIM function

SSD currently has a new storage media technology namely Solid State Drive Non-volatile Memory Express (SSD NVMe). In addition, SSD has a feature called TRIM. The TRIM feature allows the operating system to tell SSDs which blocks are not used. TRIM removes blocks that have been marked for removal by the operating system. However, the TRIM function has a negative effect for the digital forensics specifically related to data recovery. This study aimed to compare the TRIM disable and enable functions to determine the ability of forensics tools and recovery tools to restore digital evidence on the NVMe SSD TRIM function. The operating system used in this study was Windows 10 professional with NTFS file system. Typically, acquisition is conducted by using traditional or static techniques. Therefore, there was a need of a technique to acquire SSD by using the live forensics method without shutting down the running operating system. The live forensics method was applied to acquire SSD NVMe directly to the TRIM disable and enable functions. The tools used for live acquisition and recovery were FTK Imager Portable. The inspection and analysis phases used Sleutkit Autopsy and Belkasoft Evidence Center. This research found that in the recovery process of TRIM disabled and enabled, TRIM disabled could find evidence while maintaining the integrity of evidence. It was indicated by the same hash value of the original file and the recovery file. Conversely, when TRIM is enabled, the files were damaged and could not be recovered. The files were also not identical to the original so the integrity of evidence was not guaranteed.

Live Forensics Method for Acquisition on the Solid State Drive (SSD) NVMe TRIM Function

SSD currently has a new storage media technology namely Solid State Drive Non-volatile Memory Express (SSD NVMe). In addition, SSD has a feature called TRIM. The TRIM feature allows the operating system to tell SSDs which blocks are not used. TRIM removes blocks that have been marked for removal by the operating system. However, the TRIM function has a negative effect for the digital forensics specifically related to data recovery. This study aimed to compare the TRIM disable and enable functions to determine the ability of forensics tools and recovery tools to restore digital evidence on the NVMe SSD TRIM function. The operating system used in this study was Windows 10 professional with NTFS file system. Typically, acquisition is conducted by using traditional or static techniques. Therefore, there was a need of a technique to acquire SSD by using the live forensics method without shutting down the running operating system. The live forensics method was applied to acquire SSD NVMe directly to the TRIM disable and enable functions. The tools used for live acquisition and recovery were FTK Imager Portable. The inspection and analysis phases used Sleutkit Autopsy and Belkasoft Evidence Center. This research found that in the recovery process of TRIM disabled and enabled, TRIM disabled could find evidence while maintaining the integrity of evidence. It was indicated by the same hash value of the original file and the recovery file. Conversely, when TRIM is enabled, the files were damaged and could not be recovered. The files were also not identical to the original so the integrity of evidence was not guaranteed.

A model of the process of writing and deleting file information on a disk with NTFS

This paper aims at demonstrating a mathematical model of the process of writing and deleting information about files on a disk, using the contents of the $MFT system file, i.e. in a file generated in the NTFS (New Technology File System). The presented model uses the language of control theory, where the state of the system is equal to the state of the disk and the state of the $MFT file, and where control is understood as undertaking the action of writing or deleting. The deterministic nature of the process and its stationarity were assumed. Then, based on the transition function after its specification, we suggest constructing further inverse images of possible prior states at subsequent stages of data writing or deletion. The obtained results form the basis for the implementations developed.

Using NTFS Cluster Allocation Behavior to Find the Location of User Data

Digital forensics is heavily affected by the large and increasing amount of data to be processed. To solve the problem there is ongoing research to find more efficient carving algorithms, use parallel processing in the cloud, and reduce the amount of data by filtering uninteresting files.Our approach builds on the principle of searching where it is more probable to find what you are looking for. We therefore have empirically studied the behavior of the cluster allocation algorithm(s) in the New Technology File System (NTFS) to see where new data is actually placed on disk. The experiment consisted of randomly writing, increasing, reducing and deleting files in 32 newly installed Windows 7, 8, 8.1 and 10 virtual computers using VirtualBox. The result show that data are (as expected) more frequently allocated closer to the middle of the disk. Hence that area should be getting higher attention during a digital forensic investigation of a NTFS formatted hard disk.Knowledge of the probable position of user data can be used by a forensic investigator to prioritize relevant areas in storage media, without the need for a working file system. It can also be used to increase the efficiency of hash-based carving by dynamically changing the sampling frequency. Our findings also contributes to the digital forensics processes in general, which can now be focused on the interesting regions on storage devices, increasing the probability of getting relevant results faster.

Using the object ID index as an investigative approach for NTFS file systems

When investigating an incident it is important to document user activity, and to document which storage device was connected to which computer. We present a new approach to documenting user activity in computer systems using the NTFS file system by using the $ObjId Index to document user activity, and to correlate this index with the corresponding records in the MFT table. This may be the only possible approach when investigating external NTFS storage devices, and is hence a valuable addition to the storage forensics toolbox.

Writing and Deleting files on hard drives with NTFS

The goal of this article was to present detailed information about writing and deleting process on the NTFS (New Technology File System) formatted drives. The most important are the algorithms used by computer to write data BFA (Best Fit Algorithm) and FFA (First-Free Algorithm) to update $MFT (Master File Table). The naming convention of the areas of the drive is presented. The proposed rules of writing and deleting algorithm were successfully validated with real NTFS volume.

Recovering Data Using MFT Records in NTFS File System

Data storage devices use a specific structure when storing or accessing the stored data. This is called file system. Before beginning to store data in the data storage device, it must be formatted absolutely. While this data storage device is being formatted, the file system should be selected.NTFS, the most commonly used file system, keeps the files in the disk as a list in the MFT (Master File Table) file. Even if the file is deleted, the file record in this table will not be deleted. The physical location of the file can be found by looking at these MFT records.In this study, computer software was created on the basis of restoring the disk using a MFT file of the NTFS file system, and the result was examined.When national studies are examined, data recovery programs on the market are compared with each other. When international studies are examined, it is seen that NTFS and MFT concepts are explained but data recovery method using MFT records is not examined in detail.

Reconstructing ADS data hiding in windows NTFS: A temporal analysis

The Windows NTFS file system supports for alternate data streams (ADS) to provide compatibility with files in the Macintosh file system. ADS can be used for hidden channels of storing and exchanging information on machines without altering their original functionality or contents. Executables in ADS can be executed from the command line. It is common for attackers to hide malware in cover media (files or folders) by ADS creation, modification or overwriting. The temporal information is significant when the computer is on. The attributes of $SI and $FN in the Master File Table (MFT) hold the following four forensically interesting EMAC-time stamps. Timestamp dynamics refers to any influence that adds, changes, obscures, contaminates, or obliterates timestamps, regardless of intent. Getting precise information about the file metadata in the MFT is important to the assessment of the scenario of the offense.The study of file metadata and ADS manipulation assists in establishing timestamp patterns and correlating activities from timestamp evidence. Some experimental processes were conducted to identify EMAC-time stamps in $SI and $FN, collect experimental observations in MFT, examine hidden channels, analyze timeline scenario, and present artifacts and non-artifacts to reconstruct the incident. This study explores the temporal analysis facing the law enforcement community and discusses the application of Forensic Toolkit (FTK) software to copy with the increasingly ADS feature in digital forensic investigations. This study also establishes some timestamp rules on ADS manipulation, enhances the performance of investigations, and helps investigators reconstruct an incident. It is beneficial for investigators to evaluate an accident if an attacker has manipulated ADS to conceal his offense.

Disk based Forensics Analysis

Today computer systems have become integral part of our life. Its penetration in personal and organizational level has increased rapidly in last couple of years. Majority of data is now present in digital form which includes personal data like photos and videos, government documents, secrete and confidential reports of organizations, etc. This change in technology is also adopted by criminals to perform their illegal activities. Use of computers for performing crimes has increased therefore it has become necessary for investigator to collect and process evidences from suspect’s computer. Windows 7 has become mainstream operating system for users and thus its forensics investigation is becoming important. There are various places in Windows 7 which can be used in forensics analysis; some of the areas of interest are windows registry and the underlying NTFS file system. Registry contains valuable information that can be helpful for the forensics analysis. Registry contains the basic information like date when Operating System installed, owner name and the advanced information such as the software installed on system, history of recently used documents and so on, which will help the analyst to decide the way of further analysis of system depending on the its environment. The NTFS file system is native file system for Microsoft’s Windows 7 which is used to manage files present on disk. Suspect can hide data in the file system using its Alternate Data Streams feature. He/She can also remove evidence present on disk by deleting files containing evidences. It is important for forensic investigator to get back the evidences from hidden and deleted files by suspect. In this paper we have proposed and implemented tool that will be useful for performing forensics analysis of windows 7 registry, underlying NTFS file systems Alternate Data Streams and recovery of deleted files. This tool will helps in saving efforts and time of investigator in its investigation.

Following the breadcrumbs: Timestamp pattern identification for cloud forensics

This study explores the challenges of digital forensics investigation in file access, transfer and operations, and identifies file operational and behavioral patterns based on timestamps—in both the standalone as well as interactions between Windows NTFS and Ubuntu Ext4 filesystems. File-based metadata is observed, and timestamps across different cloud access behavioral patterns are compared and validated. As critical metadata information cannot be easily observed, a rigorous iterative approach was implemented to extract hidden, critical file attributes and timestamps. Direct observation and cross-sectional analysis were adopted to analyze timestamps, and to differentiate between patterns based on different types of cloud access operations. Fundamental observation rules and characteristics of file interaction in the cloud environment are derived as behavioral patterns for cloud operations. This study contributes to cloud forensics investigation of data breach incidents where the crime clues, characteristics and evidence of the incidents are collected, identified and analyzed. The results demonstrate the effectiveness of pattern identification for digital forensics across various types of cloud access operations.