applied sciences Article Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps Da-Yu Kao Department of Information Management, Central Police University, Taoyuan City 33304, Taiwan;
[email protected] Received: 1 May 2020; Accepted: 3 July 2020; Published: 7 July 2020 Abstract: When computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, and intelligence agents to erase, tamper, or conceal secrets. However, ADS problems are much ignored in digital forensics. Rare researches illustrated the contact artifacts of ADS timestamps. This paper performs a sequence of experiments from an inherited variety and provides an in-depth overview of timestamp transfer on data hiding operations. It utilizes files or folders as original media and uses the timestamp rules as an investigative approach for the forensic exchange analysis of file sets. This paper also explores timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts. The experiment results demonstrate the effectiveness of temporal attributes, help digital forensic practitioners to uncover hidden relations, and trace the contact artifacts among crime scenes, victims, and suspects/criminals. Keywords: data hiding; temporal attributes; timestamp transfer; exchange principle; trace evidence; contact artifacts; crime scene reconstruction; cybercrime investigation; digital forensics 1. Introduction Timestamps in the reconstruction of cybercrimes have proven to be an expedient source of evidence for digital forensic practitioners [1]. Active malware or criminals have implemented antiforensic techniques to hide their traces.