Vis enkel innførsel

dc.contributor.authorKarresand, Nils Martin Mikael
dc.contributor.authorAxelsson, Stefan
dc.contributor.authorDyrkolbotn, Geir Olav
dc.date.accessioned2020-01-20T11:40:24Z
dc.date.available2020-01-20T11:40:24Z
dc.date.created2019-10-01T08:47:24Z
dc.date.issued2019
dc.identifier.issn1383-469X
dc.identifier.urihttp://hdl.handle.net/11250/2636995
dc.description.abstractThe allocation algorithm of a file system has a huge impact on almost all aspects of digital forensics, because it determines where data is placed on storage media. Yet there is only basic information available on the allocation algorithm of the currently most widely spread file system; NTFS. We have therefore studied the NTFS allocation algorithm and its behavior empirically. To do that we used two virtual machines running Windows 7 and 10 on NTFS formatted fixed size virtual hard disks, the first being 64 GiB and the latter 1 TiB in size. Files of different sizes were written to disk using two writing strategies and the $Bitmap files were manipulated to emulate file system fragmentation. Our results show that files written as one large block are allocated areas of decreasing size when the files are fragmented. The decrease in size is seen not only within files, but also between them. Hence a file having smaller fragments than another file is written after the file having larger fragments. We also found that a file written as a stream gets the opposite allocation behavior, i. e. its fragments are increasing in size as the file is written. The first allocated unit of a stream written file is always very small and hence easy to identify. The results of the experiment are of importance to the digital forensics field and will help improve the efficiency of for example file carving and timestamp verification.nb_NO
dc.language.isoengnb_NO
dc.publisherSpringer Verlagnb_NO
dc.rightsNavngivelse 4.0 Internasjonal*
dc.rights.urihttp://creativecommons.org/licenses/by/4.0/deed.no*
dc.titleDisk Cluster Allocation Behavior in Windows and NTFSnb_NO
dc.typeJournal articlenb_NO
dc.typePeer reviewednb_NO
dc.description.versionpublishedVersionnb_NO
dc.source.journalJournal on spesial topics in mobile networks and applicationsnb_NO
dc.identifier.doi10.1007/s11036-019-01441-1
dc.identifier.cristin1732062
dc.relation.projectNorges forskningsråd: ArsForensica 248094nb_NO
dc.description.localcode© The Author(s) 2019 Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.nb_NO
cristin.unitcode194,63,30,0
cristin.unitnameInstitutt for informasjonssikkerhet og kommunikasjonsteknologi
cristin.ispublishedfalse
cristin.fulltextpostprint
cristin.qualitycode1


Tilhørende fil(er)

Thumbnail

Denne innførselen finnes i følgende samling(er)

Vis enkel innførsel

Navngivelse 4.0 Internasjonal
Med mindre annet er angitt, så er denne innførselen lisensiert som Navngivelse 4.0 Internasjonal