Abstract
The objectives of this chapter are to:
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
“New Technology File System (NTFS)”. http://www.pcguide.com/ref/hdd/file/ntfs/index.htm
Brian Carrier. “File System Forensic Analysis”. Addison-Wesley Professional, 2005
The Structure and Function of an Operating System. http://www.sqa.org.uk/e-learning/COS101CD/page_18.htm
http://homepage.cs.uri.edu/~thenry/csc487/video/62_MFT_Layout.pdf
http://www.cse.scu.edu/~tschwarz/coen252_07Fall/Lectures/NTFS.html
Petra Koruga, Miroslav Bača. Analysis of B-tree data structure and its usage in computer forensics. https://bib.irb.hr/datoteka/484192.B-tree.pdf
Gyu-Sang Cho. NTFS Directory Index Analysis for Computer Forensics.
NTFS: Sometimes accurate file times are not in $FILE_NAME but in $STANDARD_INFORMATION. http://jnode.org/node/2861
B-tree algorithms. http://www.semaphorecorp.com/btp/algo.html
NTFS Basics. http://ntfs.com/ntfs_basics.htm
https://technet.microsoft.com/en-us/library/cc781134(v=ws.10).aspx)
Author information
Authors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this chapter
Cite this chapter
Lin, X. (2018). Examining NTFS File System. In: Introductory Computer Forensics. Springer, Cham. https://doi.org/10.1007/978-3-030-00581-8_7
Download citation
DOI: https://doi.org/10.1007/978-3-030-00581-8_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-00580-1
Online ISBN: 978-3-030-00581-8
eBook Packages: Computer ScienceComputer Science (R0)