An Intuitive Computer Forensic Method by Timestamp Changing Patterns

Abstract

This proposes an intuitive computer forensic method by timestamp changing patterns of operations on file in Windows NTFS file system. It categorized by seven file operations and has ten distinguishable patterns by their timestamp changes. The distinct timestamp changing patterns make decision on identifying what kind of file operation is performed. Some patterns are easily identified by their distinct timestamp feature intuitively, and some patterns are needed past timestamp to identify the file operation clearly, and some patterns have ambiguity with similar timestamp patterns. With some performed cases, the forensic method is tested and presented for its usage.