Difference between pages "New Technology File System (NTFS)" and "Research Topics"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Undo revision 5472 by K4 (Talk) - Vendor spam)
 
m
 
Line 1: Line 1:
The '''New Technology File System''' ('''NTFS''') is a [[file system]] developed and introduced by [[Microsoft]] in 1993 with [[Windows]] 3.1. As a replacement for the [[FAT]] file system, it quickly became the standard for [[Windows 2000]], [[Windows XP]] and [[Windows Server 2003]].
+
Interested in doing research in computer forensics? Looking for a master's topic, or just some ideas for a research paper? Here is my list. Please feel free to add your own ideas.
  
The features of NTFS include:
+
==Disk Forensics==
 +
===Stream Forensics===
 +
Process the entire disk with one pass, or at most two, to minimize seek time. 
  
* [[Hard-links]]
+
===Evidence Falsification===
* Improved performance, reliability and disk space utilization
+
Automatically detect falsified digital evidence.
* Security [[access control lists]]
+
* File system journaling
+
  
== External links ==
+
===Sanitization===
* [http://en.wikipedia.org/wiki/NTFS Wikipedia: NTFS]
+
Detect and diagnose sanitization attempts.
[[Category:Disk file systems]]
+
 
 +
 
 +
===[[AFF]] Enhancement===
 +
* Replace the AFF "BADFLAG" approach for indicating bad data with a bad sector bitmap.
 +
 
 +
* Modify aimage so that it can take a partial disk image and a disk and just image what's missing.
 +
 
 +
* Improve the data recovery features of aimage.
 +
 
 +
* Replace AFF's current table-of-contents system with one based on B+ Trees.
 +
 
 +
==Timeline Analysis==
 +
Write a new timeline viewer that supports:
 +
* Logfile fusion (with offsets)
 +
* Logfile correlation
 +
 
 +
 
 +
==Carving==
 +
===JPEG Validator===
 +
Create a JPEG decompresser that supports restarts and checkpointing for use in high-speed carving.
 +
 
 +
 
 +
==Cell Phone Exploitation==
 +
===Imaging===
 +
Develop a tool for imaging the contents of a cell phone memory
 +
===Interpretation===
 +
* Develop a tool for reassembling information in a cell phone memory
 +
 
 +
 
 +
==Corpora Development==
 +
===Realistic Disk Corpora===
 +
There is need for realistic corpora that can be freely redistributed but do not contain any confidential personally identifiable information (PII).
 +
 
 +
These disk images may be either of an external drive or of a system boot drive. The drive images should have signs of ''wear'' --- that is, they should have resident files, deleted files, partially overwritten files, contiguous files, and fragmented files.
 +
 
 +
===Realistic Network Traffic===
 +
Generating realistic network traffic requires constructing a test network and either recording interactions within the network or with an external network.

Revision as of 15:10, 11 November 2008

Interested in doing research in computer forensics? Looking for a master's topic, or just some ideas for a research paper? Here is my list. Please feel free to add your own ideas.

Disk Forensics

Stream Forensics

Process the entire disk with one pass, or at most two, to minimize seek time.

Evidence Falsification

Automatically detect falsified digital evidence.

Sanitization

Detect and diagnose sanitization attempts.


AFF Enhancement

  • Replace the AFF "BADFLAG" approach for indicating bad data with a bad sector bitmap.
  • Modify aimage so that it can take a partial disk image and a disk and just image what's missing.
  • Improve the data recovery features of aimage.
  • Replace AFF's current table-of-contents system with one based on B+ Trees.

Timeline Analysis

Write a new timeline viewer that supports:

  • Logfile fusion (with offsets)
  • Logfile correlation


Carving

JPEG Validator

Create a JPEG decompresser that supports restarts and checkpointing for use in high-speed carving.


Cell Phone Exploitation

Imaging

Develop a tool for imaging the contents of a cell phone memory

Interpretation

  • Develop a tool for reassembling information in a cell phone memory


Corpora Development

Realistic Disk Corpora

There is need for realistic corpora that can be freely redistributed but do not contain any confidential personally identifiable information (PII).

These disk images may be either of an external drive or of a system boot drive. The drive images should have signs of wear --- that is, they should have resident files, deleted files, partially overwritten files, contiguous files, and fragmented files.

Realistic Network Traffic

Generating realistic network traffic requires constructing a test network and either recording interactions within the network or with an external network.