We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
Artifacts of CD Burning in the Microsoft Windows Master File Table.
- Authors
Elrick, Douglas
- Abstract
When theft of a physical item occurs it is detectable by the fact that the object is missing, however, when the theft of a digital item occurs it can go unnoticed as exact replicas can be created. The original file is left intact but valuable information has been absconded. One of the challenges facing digital forensic examiners is detecting when files have been copied off of a computer system in some fashion. While certain methods do leave residual evidence behind, CD Burning has long been held as a copying method that cannot be identified. Through testing of the burning process and close examination of the New Technology File System (NTFS), artifacts from the master file table in the various versions of Microsoft Windows, markers have been found that are associated with copying or 'burning' files to CD or DVD. Potential evidence that was once overlooked may now be detectable.
- Subjects
COMPACT disc reproduction; COMPACT discs; FORENSIC sciences; PIRACY prevention (Copyright); DVD authoring software; MICROSOFT Windows (Operating system); SECURITY systems
- Publication
Journal of Forensic Sciences, 2012, Vol 57, Issue 1, p103
- ISSN
0022-1198
- Publication type
Article
- DOI
10.1111/j.1556-4029.2011.01919.x