• Journal of the Korea Society of Computer and Information
• /
• v.22 no.8
• /
• pp.73-83
• /
• 2017

In this paper, we discuss the differences between an ordinary B-tree and B-tree implemented by NTFS. There are lots of distinctions between the two B-tree, if not understand the distinctions fully, it is difficult to utilize and analyze artifacts of NTFS. Not much, actually, is known about the implementation of NTFS, especially B-tree index for directory management. Several items of B-tree features are performed that includes a node size, minimum number of children, root node without children, type of key, key sorting, type of pointer to child node, expansion and reduction of node, return of node. Furthermore, it is emphasized the fact that NTFS use B-tree structure not B+structure clearly.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.6 no.2
• /
• pp.107-118
• /
• 2010

This paper proposes a digital forensic method to a file creation transaction using a journal file($LogFile) on NTFS File System. The journal file contains lots of information which can help recovering the file system when system failure happens, so knowledge of the structure is very helpful for a forensic analysis. The structure of the journal file, however, is not officially opened. We find out the journal file structure with analyzing the structure of log records by using reverse engineering. We show the digital forensic procedure extracting information from the log records of a sample file created on a NTFS volume. The related log records are as follows: bitmap and segment allocation information of MFT entry, index entry allocation information, resident value update information($FILE_NAME, $STANDARD_INFORMATION, and INDEX_ALLOCATION attribute etc.).

• International Journal of Internet, Broadcasting and Communication
• /
• v.9 no.3
• /
• pp.17-26
• /
• 2017

An anti-forensic data hiding method in an NTFS index record is a method designed for anti-forensics, which records data as a file name in index entries and thereafter the index entries are made to remain in the intentionally generated slack area in a 4KB-sized index record[7]. In this paper, we propose a maximum data allocation rule for an anti-forensic data hiding method in an NTFS index record; i.e., a computational method for storing optimal data to hide data in an index record of NTFS is developed and the optimal solution is obtained by applying the method. We confirm that the result of analyzing the case where the number of index entries n = 7 is the maximum case, and show the screen captures of index entries as experimental results.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.8 no.4
• /
• pp.327-337
• /
• 2015

This work provides new forensic techinque to a hide message on a directory index in Windows NTFS file system. Behavior characteristics of B-tree, which is apoted to manage an index entry, is utilized for hiding message in slack space of an index record. For hidden message not to be exposured, we use a disguised file in order not to be left in a file name attribute of a MFT entry. To understand of key idea of the proposed technique, we describe B-tree indexing method and the proposed of this work. We show the proposed technique is practical for anti-forensic usage with a real message hiding case using a developed software tool.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.49 no.4
• /
• pp.1-8
• /
• 2012

The NTFS journaling file($LogFile) is used to keep the file system clean in the event of a system crash or power failure. The operation on files leaves large amounts of information in the $LogFile. Despite the importance of a journal file as a forensic evidence repository, its structure is not well documented. The researchers used reverse engineering in order to gain a better understanding of the log record structures of address parts, and utilized the address for identifying object files to gain forensic information.

• The Journal of the Korea Contents Association
• /
• v.10 no.5
• /
• pp.52-61
• /
• 2010

In recent, the interests of multi-user systems have been increased. Multi-user systems allow a number of users to access the system simultaneously. Security is one of the key issues to be addressed in a multi-user environment. We propose a solution based on the NTFS file system that provides the personal data security and considers the convenience of users. The system increases the convenience of users by simplifying the complexity of the security setting on NTFS. We also propose a variety of policies that prevent from the conflicts incurring when different users set up the personal folders simultaneously and do not set up the important folders such as the window system folders as personal folders. In addition, our system supports the function of setting up the prohibition folder lists so that no one can not set the folder to their personal folders.

• Convergence Security Journal
• /
• v.15 no.7
• /
• pp.75-84
• /
• 2015

In an "NTFS Index Record Data Hiding" method messages are hidden by using file names. Windows NTFS file naming convention has some forbidden ASCII characters for a file name. When inputting Hangul with the Roman alphabet, if the forbidden characters for the file name and binary data are used, the codes are convert to a designated unicode point to avoid a file creation error due to unsuitable characters. In this paper, the problem of a file creation error due to non-admittable characters for the file name is fixed, which is used in the index record data hiding method. Using Hangul with Roman alphabet the characters cause a file creation error are converted to an arbitrary unicode point except Hangul and Roman alphabet area. When it comes to binary data, all 256 codes are converted to designated unicode area except an extended unicode(surrogate pairs) and ASCII code area. The results of the two cases, i.e. the Hangul with Roman alphabet case and the binary case, show the applicability of the proposed method.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.05a
• /
• pp.355-357
• /
• 2014

Linux environment that is commonly used at embedded systems, supports various file systems as Ext2, FAT, NTFS, ets. The file system that is equiped on the embedded system is mostly implemented on mini hard disk or flash memory. The types of the file system of the system make an effect on the performance of a application programs. The factors of file system performance on a same media are block allocation and block free time. On these factors, block free time is not so different according to the type of file systems. This thesis performs the performance benchmark of a Ext2, FAT and NTFS file systems about block allocation performance. As the result, it is discussed that what file system is better at which case.

• International Journal of Internet, Broadcasting and Communication
• /
• v.8 no.3
• /
• pp.31-40
• /
• 2016

In this paper, we propose a new anti-forensic method for hiding data in the timestamp of a file in the Windows NTFS filesystem. The main idea of the proposed method is to utilize the 16 least significant bits of the 64 bits in the timestamps. The 64-bit timestamp format represents a number of 100-nanosecond intervals, which are small enough to appear in less than a second, and are not commonly displayed with full precision in the Windows Explorer window or the file browsers of forensic tools. This allows them to be manipulated for other purposes. Every file has $STANDARD_INFORMATION and $FILE_NAME attributes, and each attribute has four timestamps respectively, so we can use 16 bytes to hide data. Without any changes in an original timestamp of "year-month-day hour:min:sec" format, we intentionally put manipulated data into the 16 least significant bits, making the existence of the hidden data in the timestamps difficult to uncover or detect. We demonstrated the applicability and feasibility of the proposed method with a test case.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.478-479
• /
• 2018

본 논문에서는 NTFS 파일시스템에서 디렉토리 인덱스의 구조내에 데이터를 숨기기 방법을 적용하는데 있어서 필요한 요소들에 대한 설명과 그것의 필요성에 대하여 논하기로 한다. 기존에 발표된 이 방법은 NTFS의 디렉토리 인덱스를 유지하기 위하여 B-tree방식으로 인덱스에 대한 데이터 구조를 운영하고 있는 점을 이용하여 인덱스의 정보를 담고 있는 인덱스 레코드 안에 저장되는 파일명을 이용하여 데이터 감추기를 수행하는 방법이다. 이것을 하기 위하여 필요한 몇가지 요소가 있는데 그 중에서 파일시스템, 작업 디렉토리, 위장 파일, 숨기려는 데이터, 사용할 수 없는 문자들, 앵커파일, 분석도구 등에 대한 것들을 나열하고 해당하는 요소들이 필요성과 그에 대한 의미를 기술하고자 한다.