Digital Forensic Usage of the Inherent Structures in NTFS

Abstract

Digital forensic investigators have for a long time been burdened by an increasing amount of data to handle. Many solutions have been proposed. A yet unexplored feature is to use the inherent structures left by the allocation algorithm. These structures can be used to build a map of the allocation activity at different positions in a file system. The map can be used to plan and optimize the search for valuable data. We therefore have studied the inherent structures in the New Technology File System (NTFS) as a proof-of-concept to explore the possibility to create such a map. The map can increase the efficiency of many digital forensic processes, which has been verified experimentally for sampled hash-based carving. In file carving the map can help both during fragment extraction, as well as during file reassembly. Our research can also be used to verify time stamps and categorize the writing type of files based on the allocation pattern. It furthermore brings new knowledge to the research fields of external fragmentation and data recovery.