Browse > Article

Method for Finding Related Object File for a Computer Forensics in a Log Record of $LogFile of NTFS File System  

Cho, Gyu-Sang (Dongyang Univ., Dept. of Computer Information Warfare)
Publication Information
Journal of the Institute of Electronics Engineers of Korea CI / v.49, no.4, 2012 , pp. 1-8 More about this Journal
Abstract
The NTFS journaling file($LogFile) is used to keep the file system clean in the event of a system crash or power failure. The operation on files leaves large amounts of information in the $LogFile. Despite the importance of a journal file as a forensic evidence repository, its structure is not well documented. The researchers used reverse engineering in order to gain a better understanding of the log record structures of address parts, and utilized the address for identifying object files to gain forensic information.
Keywords
Computer Forensics; $LogFile; Log Record; Windows NTFS;
Citations & Related Records
연도 인용수 순위
  • Reference
1 B. Carrier, File System Forensic Analysis, Addison-Wesley, pp. 340-341, 2005.
2 Mark E. Russinovich and David A. Solomon, Windows Internls, Microsoft Press, Chapter 10, pp. 995-1000, 2006
3 Pramada Singireddy, "Recoverability Support in NT File System(NTFS)", http://eas.asu.edu/ -cse532/
4 K. Dreher, "NTFS", Master Thesis of Department of Information Technology Institute of Technology, Lund, Nov., Sweden, 1998.
5 조규상, "컴퓨터 포렌식을 위한 NTFS 저널 파일의 분석", 디지털 포렌식 연구, Vol. 3, No. 1, 2009, pp. 51-60.
6 조규상.김태한, "컴퓨터 포렌식에 사용하기 위한 NTFS $LogFile의 로그 레코드 데이터 구조 분석", ICS'2000 정보 및 제어심포지엄 논문집, 2010, pp. 230-231.
7 김태한.조규상, "NTFS $LoFile에서 상주 속성 파일의 컴퓨터 포렌식", ICS'2000정보및제어심포지엄논문집, 2010, pp. 69-70.
8 김태한.조규상, "NTFS 파일 시스템의 저널 파일을 이용한 파일 생성에 대한 디지털 포렌식 방법", 디지털산업정보학회 논문지, 6권2호, pp,107-118, 2010.
9 Gyu-Sang Cho and M. Rogers, "Finding Forensic Information on Creating a Folder", Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST (Proceedings of ICDF2C 2011), Springer, 2012
10 Gyu-Sang Cho and M. Rogers, "A Computer Forensic Method for Detecting Timestamp Forgery in NTFS", Computer & Security. 2012. (예정)
11 김태한, "NTFS 파일 시스템에서 저널 파일의 역공학 분석 통한 컴퓨터 포렌식", 동양대학교 박사 학위논문, pp.26-29, 2010.
12 Richard Russon and Yuval Fledel, NTFS Documentation, Chapter 3. NTFS files:$LogFile, pp. 38-42, http://linux-ntfs.sourceforge.net