The IRMA Community
Newsletters
Research IRM
Click a keyword to search titles using our InfoSci-OnDemand powered search:
|
A New Timestamp Digital Forensic Method Using a Modified Superincreasing Sequence
Abstract
This paper proposes a new digital forensic method using a modified superincreasing sequence. Timestamp changes by file commands in Windows NTFS file system are used for identifying what commands were executed and are a useful and a logical way for performing digital forensics. A superincreasing sequence is modified for the timestamp change patterns to make each timestamp pattern have a distinct value. The method has two functions; one is a timestamp change check function and the other is a forensic evaluation function. The former checks differences of timestamps between before and after command execution, and the latter produces a characteristic output by applying ten kinds of timestamp change patterns. According to the characteristic output, the kind of command that is executed is identified. By virtue of adopting the modified superincreasing sequence, the evaluation function could produce distinct characteristic output values and thereby provides a way to reconstruct executed file commands.
Related Content
|
Vivek Bhardwaj, Bilal Ahmed, Mirza Shuja, Deepak Thakur, Tanya Gera, Mukesh Kumar.
© 2026.
26 pages.
|
|
Vivek Bhardwaj, Tanima Thakur, Mrinalini Rana, Jeyaganesh Viswanathan.
© 2026.
24 pages.
|
|
Abhishek Sharma, Abhishek Mishra, Shweta Jain, Khushboo Karodiya, Priyanka Sharma.
© 2026.
10 pages.
|
|
Akash Mishra, Nandini Bansod, Dinesh Baban Kamble.
© 2026.
18 pages.
|
|
Anjali Rawat, George Kurian, Romil Rawat, Janet Olivia Richmond, Anand Rajavat, Purvee Bhardwaj.
© 2026.
28 pages.
|
|
Antonio Gonzalez-Torres.
© 2026.
26 pages.
|
|
Anjali Rawat, A. Samson Arun Raj, Janet Olivia Richmond, Anand Rajavat, Antonio González-Torres, Purvee Bhardwaj.
© 2026.
22 pages.
|
|
|