Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
When computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, an...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-07-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/10/13/4686 |
| _version_ | 1797563119086600192 |
|---|---|
| author | Da-Yu Kao |
| author_facet | Da-Yu Kao |
| author_sort | Da-Yu Kao |
| collection | DOAJ |
| description | When computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, and intelligence agents to erase, tamper, or conceal secrets. However, ADS problems are much ignored in digital forensics. Rare researches illustrated the contact artifacts of ADS timestamps. This paper performs a sequence of experiments from an inherited variety and provides an in-depth overview of timestamp transfer on data hiding operations. It utilizes files or folders as original media and uses the timestamp rules as an investigative approach for the forensic exchange analysis of file sets. This paper also explores timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts. The experiment results demonstrate the effectiveness of temporal attributes, help digital forensic practitioners to uncover hidden relations, and trace the contact artifacts among crime scenes, victims, and suspects/criminals. |
| first_indexed | 2024-03-10T18:38:03Z |
| format | Article |
| id | doaj.art-f4bfe56d1be94ffb9e041df137a73f8a |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T18:38:03Z |
| publishDate | 2020-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-f4bfe56d1be94ffb9e041df137a73f8a2023-11-20T06:07:05ZengMDPI AGApplied Sciences2076-34172020-07-011013468610.3390/app10134686Forensic Exchange Analysis of Contact Artifacts on Data Hiding TimestampsDa-Yu Kao0Department of Information Management, Central Police University, Taoyuan City 33304, TaiwanWhen computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, and intelligence agents to erase, tamper, or conceal secrets. However, ADS problems are much ignored in digital forensics. Rare researches illustrated the contact artifacts of ADS timestamps. This paper performs a sequence of experiments from an inherited variety and provides an in-depth overview of timestamp transfer on data hiding operations. It utilizes files or folders as original media and uses the timestamp rules as an investigative approach for the forensic exchange analysis of file sets. This paper also explores timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts. The experiment results demonstrate the effectiveness of temporal attributes, help digital forensic practitioners to uncover hidden relations, and trace the contact artifacts among crime scenes, victims, and suspects/criminals.https://www.mdpi.com/2076-3417/10/13/4686data hidingtemporal attributestimestamp transferexchange principletrace evidencecontact artifacts |
| spellingShingle | Da-Yu Kao Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps Applied Sciences data hiding temporal attributes timestamp transfer exchange principle trace evidence contact artifacts |
| title | Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps |
| title_full | Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps |
| title_fullStr | Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps |
| title_full_unstemmed | Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps |
| title_short | Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps |
| title_sort | forensic exchange analysis of contact artifacts on data hiding timestamps |
| topic | data hiding temporal attributes timestamp transfer exchange principle trace evidence contact artifacts |
| url | https://www.mdpi.com/2076-3417/10/13/4686 |
| work_keys_str_mv | AT dayukao forensicexchangeanalysisofcontactartifactsondatahidingtimestamps |