NTFS 파일시스템의 타임스탬프 변경 도구들에 대한 디지털 포렌식적 분석
A Digital Forensic Analysis of Timestamp Change Tools for Windows NTFS
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
Temporal analysis is very useful and important for digital forensics for reconstructing the timeline of digital events. Forgery of a file's timestamp can lead to inconsistencies in the overall temporal relationship, making it difficult to analyze the timeline in reconstructing actions or events and the results of the analysis might not be reliable. The purpose of the timestamp change is to hide the data in a steganographic way, and the other purpose is for anti-forensics. In both cases, the time stamp change tools are requested to use. In this paper, we propose a classification method based on the behavior of the timestamp change tools. The timestamp change tools are categorized three types according to patterns of the changed timestamps after using the tools. By analyzing the changed timestamps, it can be decided what kind of tool is used. And we show that the three types of the patterns are closely related to API functions which are used to develop the tools.
Abstract
Temporal analysis is very useful and important for digital forensics for reconstructing the timeline of digital events. Forgery of a file's timestamp can lead to inconsistencies in the overall temporal relationship, making it difficult to analyze the timeline in reconstructing actions or events and the results of the analysis might not be reliable. The purpose of the timestamp change is to hide the data in a steganographic way, and the other purpose is for anti-forensics. In both cases, the time stamp change tools are requested to use. In this paper, we propose a classification method based on the behavior of the timestamp change tools. The timestamp change tools are categorized three types according to patterns of the changed timestamps after using the tools. By analyzing the changed timestamps, it can be decided what kind of tool is used. And we show that the three types of the patterns are closely related to API functions which are used to develop the tools.
참고문헌 (25)
- Sebastian Neuner, "Timestamp hiccups: Detecting manipulated filesystem timestamps on NTFS", Proc. of the 12th Int. Conf. on Availability, Reliability and Security(ARES '17) (2017)
- Gyu-Sang Cho, "A Computer Forensic Method for Detecting Timestamp Forgery in NTFS", Computer &Security, 34, pp.36~46 (2013)
- X. Ding, "Reliable Time Based Forensics in NTFS", 2010 Annual Computer Security Applications Conference (2010)
- Timestomping NTFS, "Wicher Minnaard", University of Amsterdam, Faculty of Natural Sciences, Mathematics and Computer Science, ~ (2014)
- 조규상, "Data Hiding in NTFS Timestamps for Anti-Forensics", The International Journal of Internet, Broadcasting and Communication, 8(3), pp.31~40 (2016), 한국인터넷방송통신학회[DOI]
- 조규상, "안티포렌식을 위해 비트보정 기법을 사용한 타임스탬프에 데이터 숨기기 방법", 한국컴퓨터정보학회논문지, 23(8), pp.75~84 (2018), 한국컴퓨터정보학회[DOI]
- Neuner, S, "Time is on my side: stegano- graphy in filesystem metadata", Digital Investigation, 18, pp.S76~S86 (2016)
- T. Göbel, "Anti-forensics in ext4 : On secrecy and usability of timestamp-based data hiding", Digital Investigation, 24, pp.S111~S120 (2018)
- "INFO: Working with the FILETIME Structure"[URL]
- "SetFileTime function"[URL]
- "Date Forgery Analysis and Timestamp Resolution" (2014)[URL]
- "NtSetInformation File function"[URL]
- "FILE_BASIC_INFORMATION sturcture"[URL]
- "Metasploit Anti Forensics Project"[URL]
- "SetMace"[URL]
- "IRP_MJ_WRITE"[URL]
- Ahmed A. Bahjat, "Deleted file fragment dating by analysis of allocated neighbors", Digital Investigation, 28, pp.S60~S67 (2019)
- Gyu-Sang Cho, "Digital Forensic Analysis of Timestamp Change Tools : An Anti-Forensics Perspective", Proceedings of KSCI Summer Conference 2019, 27(2), pp.391~392 (2019)
- "FileTouch"[URL]
- "chtime"[URL]
- "SKTimeStamp"[URL]
- "eXpress TimeStamp Toucher"[URL]
- "NewFileTime"[URL]
- "Bulk File Changer"[URL]