Towards a forensic-aware file system

Abstract

As the Internet has become an indivisible part of our daily life, the crime associated with it has increased dramatically as well. However, the dominant approaches currently used to fight against the cybercrime focus only on how to collect and preserve digital evidence after a crime has been committed, in which some of digital evidence could not be collected due to the design of file systems as well as the configuration of operating systems. In this paper, we proposed a proactive approach in dealing with cybercrime. We believe that with a forensic-aware file system and a properly configured operating system, the effectiveness and soundness of digital evidence will be significantly improved.