References
- N. A. Hassan and R. Hijazi, "Data Hiding Techniques in Windows OS", Elsevier, 2017.
- Ewa Huebner, Derek Bem and Cheong Kai Wee, "Data hiding in the NTFS file system,", Digital Investigation, Vol. 3, Issue 4, pp. 211-226, Dec. 2006. https://doi.org/10.1016/j.diin.2006.10.005
- Gyu-Sang Cho, "A New NTFS Anti-Forensic Technique for NTFS Index Entry," The Journal of Korea Institute of Information, Electronics, and Communication Technology, Vol. 8, No. 4, pp. 327-337, Aug. 2015. https://doi.org/10.17661/jkiiect.2015.8.4.327
- Fu-Hau Hsu1 et al., "Data concealments with high privacy in new technology file system," Journal of Supercomputing, Vol. 72, Issue 1, pp 120-140, Jan. 2016. https://doi.org/10.1007/s11227-015-1492-y
- Gyu-Sang Cho, "Data Hiding in NTFS Timestamps for Anti-Forensics", International Journal of Internet, Broadcasting and Communication, vol. 8, no. 3, pp. 31-40, Aug. 2016.
- Neuner, S. et al., "Time is on my side: steganography in filesystem metadata," Digital Investigation, Vol. 18, Supplement 7, pp. S76-S86, Aug. 2016, https://doi.org/10.1016/j.diin.2016.04.010
- Thomas Gobel and Harald Baier, "Anti-forensics in ext4: On secrecy and usability of timestamp-based data hiding," Digital Investigation, Vol. 24, pp. s111-s120, Mar. 2018. https://doi.org/10.1016/j.diin.2018.01.014
- B. Carrier, "File System Forensic Analysis", Addison-Wesley, pp. 273-396, Mar. 2005
- INFO: Working with the FILETIME Structure, https://support.microsoft.com/en-us/help/188768/info-worki ng-with-the-filetime-structure
- G.-S. Cho, "A Computer Forensic Method for Detecting Timestamp Forgery in NTFS," Computer & Security, Vol. 34, pp. 36-46. May. 2013. https://doi.org/10.1016/j.cose.2012.11.003
- Wicher Minnaard, "Timestomping NTFS," IMSc final research project report, University of Amsterdam, Faculty of Natural Sciences, Mathematics and Computer Science, Jul. 2014.
- Metasploit Anti Forensics Project, http://www.metaspl oit.com/research/projects/antiforensics/
- SetMace, "https://github.com/jschicht/SetMace"
- Chu Luo et al., "A Data Hiding Approach for Sensitive Smartphone Data," DOI: 10.1145/2971648. 2971686, Sep. 2016.
- T. Knutsson, "Filesystem Timestamps: What Makes Them Tick?," SANS Institute InfoSec Reading Room, pp. 1-27, Mar. 2016.