Global analysis of drive file times
Loading...
Authors
Rowe, Neil C.
Garfinkel, Simson L.
Subjects
forensics
drive images
timestamps
clusters
triage
diurnal
registry
drive images
timestamps
clusters
triage
diurnal
registry
Advisors
Date of Issue
2010-05
Date
May 2010
Publisher
Monterey, California. Naval Postgraduate School
Language
Abstract
Global analysis is a useful supplement to local forensic analysis of the details of files in a drive image. This paper reports on
experiments with global methods to find time patterns associated with disks and files. The Real Disk Corpus of over 1000 drive images
from eight countries was used as a corpus. The data was clustered into 63 subsets based on file and directory type, and times were
analyzed statistically for each subset. Fourteen important subsets of the files were identified based on their times, including default times
(zero, low-default, high-default, and on the hour), bursts of activity (one-time, periodic in the week, and periodic in the day), and those
having particular equalities or inequalities between any two of creation, modification, and access times. Using overall statistics for each
drive, fourteen kinds of drive usage were recognized such as a business operating primarily in the evening. Additional work examined
the connection between file times and registry times, and proposed adapting these methods to sampled rather than complete data is discussed.
Type
Conference Paper
Description
This paper appeared in the Fifth International Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, May 2010.
Series/Report No
Department
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.