This paper explores the statistical properties of microfragment recovery techniques used on NTFS filesystems in the use of digital forensics. A microfragment is the remnant file-data existing in the cluster slack after this file has been overwritten. The total amount of cluster slack is related to the size distribution of the overwriting files as well as to the size of cluster. Experiments have been performed by varying the size distributions of the overwriting files as well as the cluster sizes of the partition. These results are then compared with existing analytical models. / FIVES
| Identifer | oai:union.ndltd.org:UPSALLA1/oai:DiVA.org:kau-6000 |
| Date | January 2010 |
| Creators | Blacher, Zak |
| Publisher | Karlstads universitet, Fakulteten för ekonomi, kommunikation och IT |
| Source Sets | DiVA Archive at Upsalla University |
| Language | English |
| Detected Language | English |
| Type | Student thesis, info:eu-repo/semantics/bachelorThesis, text |
| Format | application/pdf |
| Rights | info:eu-repo/semantics/openAccess |
| Relation | Karlstad University Studies, 1403-8099 ; 06 |
Page generated in 0.0014 seconds