scholarly journals Disk based Forensics Analysis

Author(s):  
Premchand Ambhore ◽  
Archanam Wankhade ◽  
B.B. Meshram

Today computer systems have become integral part of our life. Its penetration in personal and organizational level has increased rapidly in last couple of years. Majority of data is now present in digital form which includes personal data like photos and videos, government documents, secrete and confidential reports of organizations, etc. This change in technology is also adopted by criminals to perform their illegal activities. Use of computers for performing crimes has increased therefore it has become necessary for investigator to collect and process evidences from suspect’s computer. Windows 7 has become mainstream operating system for users and thus its forensics investigation is becoming important. There are various places in Windows 7 which can be used in forensics analysis; some of the areas of interest are windows registry and the underlying NTFS file system. Registry contains valuable information that can be helpful for the forensics analysis. Registry contains the basic information like date when Operating System installed, owner name and the advanced information such as the software installed on system, history of recently used documents and so on, which will help the analyst to decide the way of further analysis of system depending on the its environment. The NTFS file system is native file system for Microsoft’s Windows 7 which is used to manage files present on disk. Suspect can hide data in the file system using its Alternate Data Streams feature. He/She can also remove evidence present on disk by deleting files containing evidences. It is important for forensic investigator to get back the evidences from hidden and deleted files by suspect. In this paper we have proposed and implemented tool that will be useful for performing forensics analysis of windows 7 registry, underlying NTFS file systems Alternate Data Streams and recovery of deleted files. This tool will helps in saving efforts and time of investigator in its investigation.

2015 ◽  
Vol 44 (4) ◽  
pp. 451-461 ◽  
Author(s):  
Algimantas Venčkauskas ◽  
Vacius Jusas ◽  
Kęstutis Paulikas ◽  
Jevgenijus Toldinas

BitTorrent client application is a popular tool to download large files from Internet, but this application is quite frequently used for illegal purposes that are one of the types of cybercrimes. If order to fight against this type of cybercrime we carried out the research, during which we investigated the evidences left by BitTorrent client application in registry under Windows 8.1 operating system. The experiment was carried out in three steps: installation, download, and uninstallation. The snapshots of registry were taken and compared prior and after each step. Changes in Windows registry were collected and joined into tables. The experiment revealed that BitTorrent client application creates Windows registry artefacts that can contain information which might be used as evidence during an investigation. The evidence remains in the registry even after the removal of the application, although it can really prove the fact of usage of the application only. The investigation of file system can reveal the purpose and the contents of the BitTorrent client session.DOI: http://dx.doi.org/10.5755/j01.itc.44.4.13082


2016 ◽  
Vol 12 (09) ◽  
pp. 26 ◽  
Author(s):  
James Wolfer ◽  
William J. Keeler

Operating systems interface between hardware and the user, random numbers are useful for security and simulation, and file systems form the program access to them in a modern operating system.   Blending these items into a remotely accessed infrastructure forms the basis for supporting operating systems projects.  This work describes the hardware, software, and communication infrastructure to support student projects by sharing remote hardware to acquire background radiations events with a Geiger counter, transforming those events into random numbers, and providing those numbers through a custom file system.  Collectively, the hardware and software provide an inexpensive remote laboratory experience for computing students.


2018 ◽  
pp. 306-312
Author(s):  
Veniamin F. Zima ◽  

The reviewed work is devoted to a significant, and yet little-studied in both national and foreign scholarship, issue of the clergy interactions with German occupational authorities on the territory of the USSR in the days of the Great Patriotic War. It introduces into scientific use historically significant complex of documents (1941-1945) from the archive of the Office of the Metropolitan Sergius (Voskresensky) of Vilnius and Lithuania, patriarchal exarch in Latvia and Estonia, and also records from the investigatory records on charges against clergy and employees concerned in the activities of the Pskov Orthodox Mission (1944-1990). Documents included in the publication are stored in the archives of Moscow, St. Petersburg, Estonia, Lithuania, Leningrad, Novgorod, and Pskov regions. They allow some insight into nature, forms, and methods of the Nazi occupational regime policies in the conquered territories (including policies towards the Church). The documents capture religious policies of the Nazis and inner life of the exarchate, describe actual situation of population and clergy, management activities and counterinsurgency on the occupied territories. The documents bring to light connections between the exarchate and German counterintelligence and reveal the nature of political police work with informants. They capture the political mood of population and prisoners of war. There is information on participants of partisan movement and underground resistance, on communication net between the patriarchal exarchate in the Baltic states and the German counterintelligence. Reports and dispatches of the clergy in the pay of the Nazis addressed to the Metropolitan Sergius (Voskresensky) contain detailed activity reports. Investigatory records contain important biographical information and personal data on the collaborators. Most of the documents, being classified, have never been published before.


2020 ◽  
Author(s):  
Fahad Alanezi

UNSTRUCTURED E-health system is emerging and providing health services and solutions through different electronic gadgets. Saudi Arabia has launched a program called Saudi Arabia vision 2030, in which providing state-of-the-art health facilities to their citizen is of topmost priority. After all the efforts, the residents of Saudi Arabia are still reluctant for the adaptation of e-health system. The current study was conducted to evaluate the obstacle in adoption of the e-health system through the mobile phones. The current study was cross-sectional survey and was conducted by developing a self-administered structured questionnaire asking the utilization of mobile phone in state of health emergency prior to ask any medical history. Majority of the participants was married and doing jobs in different firms and have their personal mobile phones (p = 0.100, > 0.05) which indicates easily access to the e-health apps. The majority of the participants suffers from either obesity or high blood pressure (p = 0.018, < 0.05) regardless of either history of mental disorder or other family history of mental diseases. The pattern of diseases with mental disorders correlate well with adoption of e-health in government policies. The obstacles in adopting e-health includes fear of the loss of personal data and information (p = 0.0401, < 0.05). Moreover, they did not trust on online medications as the doctor cannot prescribe medicines without seeing physical health of the patient. The current study concluded that by making improvement in policies and proper commercializing the e-health apps together with awareness programs can boast the adoption of e-health in Saudi Arabia.


2012 ◽  
Vol 263-266 ◽  
pp. 1979-1986
Author(s):  
Qiang Li ◽  
Li Gu Zhu ◽  
Sai Feng Zeng

Updates discovery is the key problem of data synchronization; it has been used to generate updates operations. The traditional algorithms ignore the modify semanteme, cause the updates operations increased. A new file updating discovery algorithm that supports semantic synchronization is proposed in this paper. The algorithm takes advantage of semantic info, which preserved in file system journal, to accurately recognize users originally modify intents. We take the NTFS file system as an example to realize and test the new algorithm. By comparison, the algorithm effectively reduces synchronization requests. Experiments show that, the algorithm cans timely respond to users’ modification and support massive file changes that occurred in short time. The algorithm is designed based on the basic features of file system journal, and can be applied to other file systems.


Author(s):  
Yuan Zhi Ou

Abstract Ethnicity, religion, and geopolitics affect historians’ interpretations of the history of Xinjiang, a very chaotic frontier region of China that did not come fully under the control of the People’s Republic of China until recent decades. The case of Sheng Shicai, an early Republican Era Chinese military officer, shows how professional training and, most importantly, the ability to capitalize on emerging opportunities contributed to his military success in Xinjiang from 1931 to 1934. This paper analyzes the Republic of China’s government documents, Sheng and his acquaintances’ memoirs, newspaper articles, and other sources to examine how Sheng applied his military training and employed regional and foreign military forces to win battles in northern Xinjiang. Professional military training helped officers to utilize their resources efficiently and take advantage of their geopolitical situations. Amid numerous talented Chinese military officers, Sheng rose in rank and successfully secured Xinjiang as a part of the Republic of China even when Xinjiang’s geopolitics seemed extremely challenging. This study highlights the value of Sheng’s military prowess, something that the literature has not previously appreciated.


2021 ◽  
Vol 17 (3) ◽  
pp. 1-25
Author(s):  
Bohong Zhu ◽  
Youmin Chen ◽  
Qing Wang ◽  
Youyou Lu ◽  
Jiwu Shu

Non-volatile memory and remote direct memory access (RDMA) provide extremely high performance in storage and network hardware. However, existing distributed file systems strictly isolate file system and network layers, and the heavy layered software designs leave high-speed hardware under-exploited. In this article, we propose an RDMA-enabled distributed persistent memory file system, Octopus + , to redesign file system internal mechanisms by closely coupling non-volatile memory and RDMA features. For data operations, Octopus + directly accesses a shared persistent memory pool to reduce memory copying overhead, and actively fetches and pushes data all in clients to rebalance the load between the server and network. For metadata operations, Octopus + introduces self-identified remote procedure calls for immediate notification between file systems and networking, and an efficient distributed transaction mechanism for consistency. Octopus + is enabled with replication feature to provide better availability. Evaluations on Intel Optane DC Persistent Memory Modules show that Octopus + achieves nearly the raw bandwidth for large I/Os and orders of magnitude better performance than existing distributed file systems.


2018 ◽  
Vol 48 (5) ◽  
pp. 627-636
Author(s):  
Dan Bouk

A mid-1960s proposal to create a National Data Center has long been recognized as a turning point in the history of privacy and surveillance. This article shows that the story of the center also demonstrates how bureaucrats and researchers interested in managing the American economy came to value personal data stored as “data doubles,” especially the cards and files generated to represent individuals within the Social Security bureaucracy. The article argues that the United States welfare state, modeled after corporate life insurance, created vast databanks of data doubles that later became attractive to economic researchers and government planners. This story can be understood as helping to usher in our present age of personal data, one in which data doubles have become not only commodities, but the basis for a new capitalism. This essay is part of a special issue entitled Histories of Data and the Database edited by Soraya de Chadarevian and Theodore M. Porter.


2019 ◽  
Vol 3 (9) ◽  
pp. 283-289
Author(s):  
Shuchi Sukul ◽  
Goldy Rathee ◽  
Parimal Anand ◽  
Sakshi Kataria ◽  
Pratibha Taneja

OBJECTIVES: The present research was conducted to assess incidences of root microcracks caused by hand and rotary file system at different lengths MATERIAL AND METHODS: This in-vitro study was undertaken to assess incidence of root microcracks caused by hand and rotary file system at different lengths In total, 100 the mandibular premolar with straight roots determined with intact, fully formed apices were taken. Samples were randomly distributed into 5 groups based on the file system used: a) Group A: Control, b) Group B: Reciproc, c) Group C: WaveOne, d) Group D: One Shape and e) Group E: ProTaper. Pearson Chi-square test was used to determine the differences between groups. The dentinal defects were expressed as percentage of samples with microcracks in each group. Level of statistical significance was set at p-value less than 0.05. RESULTS: The chi square test was used to compare the Distribution of the number of teeth in which cracks were observed on the horizontal sections. It was found to be significant with group ProTaper showing maximum cracks at 3,6,9 mm level as compared to other file systemCONCLUSION: Nickel-titanium instruments causes cracks on the apical root surface or in the root canal wall. ProTaper causes maximum dentinal cracks as compared to other file systems


2021 ◽  
Author(s):  
Sara A Ghitani ◽  
Maha A Ghanem ◽  
Eman A Sultan ◽  
Maram Atef ◽  
Maii F Henaidy

Abstract Background: In October 2019, 94 patients were admitted into Alexandria Poison Center (APC) with a history of ingestion of Feseekh (salted fish). As a trial to allocate the resources, not all patients were given Heptavalent botulinum antitoxin (HBAT) immediately.The current study aimed to portray the clinical characteristics of the cases, explore the possible relation between these characteristics and necessity of HBAT administration, explore the reliability of MLT, and to establish a clinical guide for management with preservation of resources.Subject and Method: the current prospective study included 94 patients who were admitted to Alexandria Poison Center (APC) in the period from 29 th September to 27 th October 2019. The patients' data was recorded using a checklist that includes: personal data, past medical history, clinical assessment, investigations, treatment and the outcome. The checklist was carried out to assess and follow up each patient. Hospitalized patients were categorized according to symptoms consistent with botulism. The equine HBAT, made by Emergent BioSolutions Canada Inc. (formerly Can gene Corporation) was used in the treatment.Results: HBAT was given to (36.2%) patients only out of the total admission. However, 87.2% of patients were completely cured, whereas 10.6% of patients were discharged with mild neurological sequelea and death occurred only in two cases (2.2%).Conclusion: 63.8% of cases with suspected foodborne botulism toxicity could be managed by supportive treatment only with no need for HBAT.


Sign in / Sign up

Export Citation Format

Share Document