dc.contributor.author | Nordvik, Rune | |
dc.contributor.author | Toolan, Fergus | |
dc.contributor.author | Axelsson, Stefan | |
dc.date.accessioned | 2019-08-07T11:43:22Z | |
dc.date.available | 2019-08-07T11:43:22Z | |
dc.date.created | 2019-06-11T09:31:11Z | |
dc.date.issued | 2019 | |
dc.identifier.citation | Digital Investigation. The International Journal of Digital Forensics and Incident Response. 2019, 28 S30-S39. | nb_NO |
dc.identifier.issn | 1742-2876 | |
dc.identifier.uri | http://hdl.handle.net/11250/2607450 | |
dc.description.abstract | When investigating an incident it is important to document user activity, and to document which storage device was connected to which computer. We present a new approach to documenting user activity in computer systems using the NTFS file system by using the $ObjId Index to document user activity, and to correlate this index with the corresponding records in the MFT table. This may be the only possible approach when investigating external NTFS storage devices, and is hence a valuable addition to the storage forensics toolbox. | nb_NO |
dc.language.iso | eng | nb_NO |
dc.publisher | Elsevier | nb_NO |
dc.rights | Attribution-NonCommercial-NoDerivatives 4.0 Internasjonal | * |
dc.rights.uri | http://creativecommons.org/licenses/by-nc-nd/4.0/deed.no | * |
dc.title | Using the object ID index as an investigative approach for NTFS file systems | nb_NO |
dc.type | Journal article | nb_NO |
dc.type | Peer reviewed | nb_NO |
dc.description.version | publishedVersion | nb_NO |
dc.source.pagenumber | S30-S39 | nb_NO |
dc.source.volume | 28 | nb_NO |
dc.source.journal | Digital Investigation. The International Journal of Digital Forensics and Incident Response | nb_NO |
dc.identifier.doi | 10.1016/j.diin.2019.01.013 | |
dc.identifier.cristin | 1703834 | |
dc.description.localcode | © 2019 The Author(s). Published by Elsevier Ltd on behalf of DFRWS. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/). | nb_NO |
cristin.unitcode | 194,63,30,0 | |
cristin.unitname | Institutt for informasjonssikkerhet og kommunikasjonsteknologi | |
cristin.ispublished | true | |
cristin.fulltext | original | |
cristin.qualitycode | 1 | |