Forensic Analysis of NTFS Metadata Artifacts for Deleted File Reconstruction

The results of the study show that a great deal of material left behind after the so-called “permanent” deletion of files in an NTFS environment can be found in various metadata structures within the NTFS file system. Researchers analyzed the 12-week project through both the analysis of the low-level data (hex-level analysis) and high-level analyses (such as calendar analysis) and studied the history of evidence. It was found that the following results were obtained as part of this study: •  High Metadata Retention Rate: 80% of critically relevant metadata, such as the original name of the file and its as-sociated MAC timestamp, will still exist after performing a controlled “Shift + Delete” operation in relation to the $MFT and $LogFile. •  Tools Have Disparate Capabilities: Automated tools like Autopsy are useful for quickly developing timeline visu-alizations of evidence, but investigators need to conduct manual examinations of evidence to locate residual data that their ingest modules may not be able to detect using tools like The Sleuth Kit (TSK) and hex editors. •  Methodological Validity: The study employed bit-stream imaging and SHA-256 hash verification as methods to maintain the integrity of the experimental data, which met the requirements for a rigorous approach to digital forensic analysis. The ongoing analysis of NTFS metadata by digital forensic investigators will provide a compelling means of establishing the integrity of digital evidence. While the evolution of anti-forensic tools will continue to pose challenges, there will be significant value in maintaining a firm understanding of the internal structures of NTFS file system management files, specifically, the $MFT, $Bitmap, and $LogFile.

[1]     Thompson, “Women and feminism in technical communication,” J. Bus. Tech. Commun., vol. 13, no. 2, pp. 154–178, 1999. [2]     M. S. MacNealy, Strategies for Empirical Research in Writing. Boston, MA: Allyn and Bacon, 1999. [3]     J. H. Watt and S. A. van den Berg, Research Methods for Communica-tion Science. Boston, MA: Allyn and Bacon, 1995. [4]     S. Kleinmann, “The reciprocal relationship of workplace culture and review,” in Writing in the Workplace: New Research Perspectives, R. Spilka, Ed. Carbondale, IL: Southern Illinois University Press, 1993, pp. 56–70. [5]     K. St. Amant, “Virtual office communication protocols: A system for managing international virtual teams,” in Proc. IEEE Int. Professional Commun. Conf., 2005, pp. 703–717. [6]     Structural Engineering Society–International. [Online]. Available: http://www.seaint.org. [7]     M. Tohidi et al., “Getting the right design and the design right: Testing many is better than one,” in Proc. ACM-SIGCHI Conf. on Human Factors in Computing Syst. (CHI’06), 2006, pp. 1243-1252. [8]     B. Carrier, File System Forensic Analysis, Addison-Wesley Professional, 2005. [9]     M. Russinovich, D. Solomon, and A. Ionescu, Windows Internals, Microsoft Press, 2012. [10]    J. Sammons, The Basics of Digital Forensics, Syngress, 2014. [11]    A. S. Lim, ”A Forensic Analysis of the NTFS LogFile,” Journal of Digital Forensics, 2011. [12]    NIST, ”Computer Forensics Tool Testing Program (CFTT),” National Institute of Standards and Technology, 2023. [13]    G. Richard III and V. Roussev, ”Scalable Digital Forensics,” Communi-cations of the ACM, 2021. [14]    H. Carvey, Windows Forensic Analysis Toolkit, Syngress, 2014.