일반 B-트리와 NTFS B-트리의 비교: 디지털포렌식 관점에서
Ordinary B-tree vs NTFS B-tree: A Digital Forensics Perspectives
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this paper, we discuss the differences between an ordinary B-tree and B-tree implemented by NTFS. There are lots of distinctions between the two B-tree, if not understand the distinctions fully, it is difficult to utilize and analyze artifacts of NTFS. Not much, actually, is known about the implementation of NTFS, especially B-tree index for directory management. Several items of B-tree features are performed that includes a node size, minimum number of children, root node without children, type of key, key sorting, type of pointer to child node, expansion and reduction of node, return of node. Furthermore, it is emphasized the fact that NTFS use B-tree structure not B+structure clearly.
Abstract
In this paper, we discuss the differences between an ordinary B-tree and B-tree implemented by NTFS. There are lots of distinctions between the two B-tree, if not understand the distinctions fully, it is difficult to utilize and analyze artifacts of NTFS. Not much, actually, is known about the implementation of NTFS, especially B-tree index for directory management. Several items of B-tree features are performed that includes a node size, minimum number of children, root node without children, type of key, key sorting, type of pointer to child node, expansion and reduction of node, return of node. Furthermore, it is emphasized the fact that NTFS use B-tree structure not B+structure clearly.
참고문헌 (20)
- Jun Huang, "The Research of Fast File Destruction Based on NTFS", ECICE 2012, AISC, 146, pp.613~619 (2012)
- Ellis Horowitz, "Fundamentals of Data Structures in C++" (2007), Silicon Press
- "B+ tree"[URL]
- Dominic Giampaolo, "Practical File System Design: The Be File System", pp.40~44 (1999), Morgan Kaufmann Publishers, Inc
- "NTFS INDX Attribute Parsing"[URL]
- "NTFS $I30 Index Attributes: Evidence of Deleted and Overwritten Files"[URL]
- "Incident Response with NTFS INDX Buffers - Parts 1, 2, 3 and 4"[URL]
- Gyu-Sang Cho, "NTFS Directory Index Analysis for Computer Forensics", Proceedings of IMIS 2015, pp.441~446 (2015)
- 조규상, "새로운 NTFS 디렉토리 인덱스 안티포렌식 기법", 한국정보전자통신기술학회 논문지, 8(4), pp.327~337 (2015), 한국정보전자통신기술학회
- 조규상, "유니코드 변환이 적용된 NTFS 인덱스 레코드에 데이터를 숨기기 위한 안티포렌식 기법", 융합보안 논문지, 15(7), pp.75~84 (2015), 한국융합보안학회
- 조규상, "Windows 파일시스템의 디렉토리에 대한 디지털 포렌식 분석", (사)디지털산업정보학회 논문지, 11(2), pp.73~90 (2015), (사)디지털산업정보학회[DOI]
- "B-tree"[URL]
- "How NTFS Works"[URL]
- "NTFS"[URL]
- B. Carrier, "File System Forensic Analysis", pp.273~396 (2005), Addison -Wesley
- Timestomping NTFS, IMSc final research project report, "Wicher Minnaard", University of Amsterdam, Faculty of Natural Sciences, Mathematics and Computer Science, ~ (2014)
- Wasim Ahmad Bhat, "A Quick Review of On-Disk Layout of Some Popular Disk File Systems", Global Journal of Computer Science & Technology, 11(Issue 1) (2011)
- Petra Grd, "Analysis of B-tree data structure and its usage in computer forensics", Proc. of the 21st Central European Conf. on Information and Intelligent Systems, pp.423~428 (2010)
- "Fsutil behavior"[URL]