Global analysis of drive file times
Abstract
Global analysis is a useful supplement to local forensic analysis of the details of files in a drive image. This paper reports on
experiments with global methods to find time patterns associated with disks and files. The Real Disk Corpus of over 1000 drive images
from eight countries was used as a corpus. The data was clustered into 63 subsets based on file and directory type, and times were
analyzed statistically for each subset. Fourteen important subsets of the files were identified based on their times, including default times
(zero, low-default, high-default, and on the hour), bursts of activity (one-time, periodic in the week, and periodic in the day), and those
having particular equalities or inequalities between any two of creation, modification, and access times. Using overall statistics for each
drive, fourteen kinds of drive usage were recognized such as a business operating primarily in the evening. Additional work examined
the connection between file times and registry times, and proposed adapting these methods to sampled rather than complete data is discussed.
Description
This paper appeared in the Fifth International Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, May 2010.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.Collections
Related items
Showing items related by title, author, creator and subject.
-
Diesel Submarine Support to SOF
Ferrer, Geraldo; Veronneau, Simon (Monterey, California: Naval Postgraduate SchoolMonterey, California. Naval Postgraduate School, 2019-12); NPS-19-N062-AGiven the limited availability of submarines to support SOF and the potential to save billions of dollars, as well as improve a capability through quiet, shallow-water capable submarines, a review of potential diesel-electric ... -
Diesel Submarine Support to SOF
Ferrer, Geraldo; Veronneau, Simon (Monterey, California: Naval Postgraduate SchoolMonterey, California. Naval Postgraduate School, 2019-12); NPS-19-N062-AGiven the limited availability of submarines to support SOF and the potential to save billions of dollars, as well as improve a capability through quiet, shallow-water capable submarines, a review of potential diesel-electric ... -
Maritime Strategy and Naval Innovation (Continuation)
Russell, James A.; Wirtz, Jim (Monterey, California: Naval Postgraduate SchoolMonterey, California. Naval Postgraduate School, 2019-12); NPS-19-N001-AThis project is a continuation of ongoing support by NPS to the work of N50 to further refining and improving the Navy's strategy development and implementation processes. This will be the fourth year of support to the ...