Jove
Visualize
Contact Us

Related Experiment Videos

Media analyses based on Microsoft NTFS file ownership.

Fred C Kerr1

  • 1Information Systems Management, Applied Management and Decision Sciences, Walden University, 155 Fifth Avenue, Minneapolis, MN 55401, USA. fkerr001@waldenu.edu

Forensic Science International
|August 1, 2006
PubMed
Summary
This summary is machine-generated.

Related Concept Videos

You might also read

Related Articles

Articles linked to this work by shared authors, journal, and citation graph.

Sort by
Same journal

Technical note: Development of a UHPLC-MS/MS method for the analysis of hCG and IGF-I from dried blood spots: A preliminary study.

Forensic science international·2026
Same journal

A novel and robust deep learning model for sibling firearm matching.

Forensic science international·2026
Same journal

Changes in C-reactive protein levels over time in high-temperature environments using postmortem blood.

Forensic science international·2026
Same journal

Insights from the first synthetic cannabinoid clandestine lab dismantled in Brazil.

Forensic science international·2026
Same journal

Determination of the new psychoactive substances MDMB-4en-PINACA, ADB-BUTINACA and some of their metabolites in blood and urine using DLLE-LC-MS/MS: application to real forensic case samples.

Forensic science international·2026
Same journal

The revolver halo as a forensic marker: Raman spectroscopic evidence of primer-driven gunshot residue deposition.

Forensic science international·2026
See all related articles
JoVE
x logofacebook logolinkedin logoyoutube logo
ABOUT JoVE
OverviewLeadershipBlogJoVE Help Center
AUTHORS
Publishing ProcessEditorial BoardScope & PoliciesPeer ReviewFAQSubmit
LIBRARIANS
TestimonialsSubscriptionsAccessResourcesLibrary Advisory BoardFAQ
RESEARCH
JoVE JournalMethods CollectionsJoVE Encyclopedia of ExperimentsArchive
EDUCATION
JoVE CoreJoVE BusinessJoVE Science EducationJoVE Lab ManualFaculty Resource CenterFaculty Site
Terms & Conditions of Use
Privacy Policy
Policies

Digital investigators can use file ownership in New Technology File System (NTFS) to quickly identify user activity on computers. This method offers a potentially viable new tool for digital forensic examinations.

Area of Science:

  • Digital Forensics
  • Computer Science

Background:

  • Digital media size increases challenges for investigators needing to rapidly assess computer media for evidence.
  • Expediting digital evidence examination is crucial for effective digital investigations.

Purpose of the Study:

  • To investigate the utility of file ownership as an analytical tool in digital forensics.
  • To focus on identifying individual activity associated with a computer using file ownership data.

Main Methods:

  • Focused research on the New Technology File System (NTFS), the default file system for Microsoft Windows.
  • Examined how digital forensic software can analyze NTFS file attributes, specifically file ownership.
  • Considered the widespread use of Windows OS and NTFS in digital forensic examinations.

Related Experiment Videos

Main Results:

  • File ownership is a property accessible through modern digital forensic software for NTFS.
  • The study outlines potential limitations in interpreting findings related to file ownership.
  • Identified areas for future research to refine the use of file ownership as a forensic tool.

Conclusions:

  • File ownership presents a potentially valuable new tool for digital forensic investigations.
  • Leveraging file ownership can aid in identifying individual user activity on computer systems.
  • Further research is needed to fully understand and mitigate limitations in interpreting ownership data.