Abstract
The objectives of this chapter are to:
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
“New Technology File System (NTFS)”. http://www.pcguide.com/ref/hdd/file/ntfs/index.htm
Brian Carrier. “File System Forensic Analysis”. Addison-Wesley Professional, 2005
The Structure and Function of an Operating System. http://www.sqa.org.uk/e-learning/COS101CD/page_18.htm
http://homepage.cs.uri.edu/~thenry/csc487/video/62_MFT_Layout.pdf
http://www.cse.scu.edu/~tschwarz/coen252_07Fall/Lectures/NTFS.html
Petra Koruga, Miroslav Bača. Analysis of B-tree data structure and its usage in computer forensics. https://bib.irb.hr/datoteka/484192.B-tree.pdf
Gyu-Sang Cho. NTFS Directory Index Analysis for Computer Forensics.
NTFS: Sometimes accurate file times are not in $FILE_NAME but in $STANDARD_INFORMATION. http://jnode.org/node/2861
B-tree algorithms. http://www.semaphorecorp.com/btp/algo.html
NTFS Basics. http://ntfs.com/ntfs_basics.htm
https://technet.microsoft.com/en-us/library/cc781134(v=ws.10).aspx)
Author information
Authors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this chapter
Cite this chapter
Lin, X. (2018). Examining NTFS File System. In: Introductory Computer Forensics. Springer, Cham. https://doi.org/10.1007/978-3-030-00581-8_7
Download citation
DOI: https://doi.org/10.1007/978-3-030-00581-8_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-00580-1
Online ISBN: 978-3-030-00581-8
eBook Packages: Computer ScienceComputer Science (R0)