Global analysis of drive file times
Rowe, Neil C.
Garfinkel, Simson L.
MetadataShow full item record
Global analysis is a useful supplement to local forensic analysis of the details of files in a drive image. This paper reports on experiments with global methods to find time patterns associated with disks and files. The Real Disk Corpus of over 1000 drive images from eight countries was used as a corpus. The data was clustered into 63 subsets based on file and directory type, and times were analyzed statistically for each subset. Fourteen important subsets of the files were identified based on their times, including default times (zero, low-default, high-default, and on the hour), bursts of activity (one-time, periodic in the week, and periodic in the day), and those having particular equalities or inequalities between any two of creation, modification, and access times. Using overall statistics for each drive, fourteen kinds of drive usage were recognized such as a business operating primarily in the evening. Additional work examined the connection between file times and registry times, and proposed adapting these methods to sampled rather than complete data is discussed.
This paper appeared in the Fifth International Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, May 2010.
RightsThis publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.
Showing items related by title, author, creator and subject.
Knight, Steven D. (Monterey, California. Naval Postgraduate School, 1998-06-01);As the Department of Defense (DoD) continually relies more on Modeling and Simulation (M&S) for testing, analyzing, and training, issues of interoperability have become one of the most important concerns. As such, DoD ...
Borah, David C. (Monterey, California. Naval Postgraduate School, 1995-06);The purpose of this thesis is to report the status of financial analysis of private sector firms as it is presently being conducted within the Department of Defense. In doing so, this thesis describes and compares five ...
Lewis, Peter A. W. (Monterey, California. Naval Postgraduate School, 1976-09); NPS 55Lw76091We describe recent results in the development of methodology of the statistical analysis of univariate series of events (point processes) and give some references to applications in the analysis and evaluation of computer ...