New paper: Analysis of hidden data in the NTFS file system

As the need for computer forensics grows, so does the ability for investigators to stay up to date on all the operating systems.

1 in 3 U.S. employees use their own computer to enable remote work, creating more data in more places than ever before.

To reveal the full picture of an investigation, it is essential corporate investigators and eDiscovery professionals can quickly analyze computer volumes for a smart, comprehensive analysis on Windows and Mac.

In this Cellebrite webinar, Monica Harris, Product Manager with Cellebrite Enterprise Solutions, and Bob Keeney, Software Developer with Cellebrite Enterprise Solutions, walk corporate investigators and eDiscovery professionals through the latest Windows Registry settings and latest Mac artifacts to help reveal the full picture when conducting computer investigations.

With AI-assisted picture and video categorization capabilities, powerful filtering, and support for the latest systems for whole disk encryption, Investigators can see the entire timeline of an event and reveal the real story behind each case. Designed to scale with any case size, Cellebrite’s smart analysis solutions enable easy filtering and the ability to sift through large data sets.

Researcher Gaëtan Michelet talks about basing his team’s work on the highly contextualized definitions for automation in business processes, and plans for refining their definition, selecting rubrics, and creating a common glossary for terms relative to automation.

Forensic investigations are often conducted under limited resource availability such as time, equipment, and people.

As data acquisition is resource-demanding already, a higher emphasis needs to be put on prioritizing the investigative steps to optimize the probability of collecting the relevant evidence.

Data volatility measures how quickly data disappears from a system and is an essential part of assessing the likelihood of collecting the most valuable evidence.

An investigator can use a model for the volatility to estimate the probability of the existence of evidence.

This work motivates and details a model for data volatility and exemplifies it for the Coffee File System used in Contiki OS, an operating system for IoT devices.

Researchers conducted experiments to test how well the model corresponds to the collected simulated data and cross-validate the model with observations from file system operations.

The results revealed that an approximated model based on the known workings of the file system underestimated the volatility.

While there are many sources describing volatility qualitatively, there is little research on quantitative volatility, and this paper is a stepping stone to understanding a quantitative approach to evidence volatility.

For more information see https://dfrws.org/presentation/quantifying-data-volatility-for-iot-forensics-with-examples-from-contiki-os/