Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Cluster-Slack Retention Characteristics: A Study of the NTFS Filesystem
Karlstad University, Faculty of Economic Sciences, Communication and IT.
2010 (English)Independent thesis Advanced level (degree of Master (One Year)), 15 credits / 22,5 HE creditsStudent thesis
Abstract [en]

This paper explores the statistical properties of microfragment recovery techniques used on NTFS filesystems in the use of digital forensics. A microfragment is the remnant file-data existing in the cluster slack after this file has been overwritten. The total amount of cluster slack is related to the size distribution of the overwriting files as well as to the size of cluster. Experiments have been performed by varying the size distributions of the overwriting files as well as the cluster sizes of the partition. These results are then compared with existing analytical models.

Place, publisher, year, edition, pages
2010. , p. 89
Series
Karlstad University Studies, ISSN 1403-8099 ; 06
Keywords [en]
NTFS, Fragment, Microfragment, Cluster, Cluster Slack, Slack, FIVES, Digital Forensics, Partition, Cylinder, Head, Sector
National Category
Information Systems
Identifiers
URN: urn:nbn:se:kau:diva-6000OAI: oai:DiVA.org:kau-6000DiVA, id: diva2:326464
Presentation
2010-06-10, 10:15 (English)
Uppsok
Technology
Supervisors
Examiners
Projects
FIVESAvailable from: 2010-06-28 Created: 2010-06-23 Last updated: 2018-01-12Bibliographically approved

Open Access in DiVA

fulltext(587 kB)995 downloads
File information
File name FULLTEXT01.pdfFile size 587 kBChecksum SHA-512
f7aaeb1b19e455e73928e88f01c820ebf9ae31db6e2117660972c7248709af9f7ace643abe3c35a20c428211a7807af0eba583a5112e49acfcc8689354497071
Type fulltextMimetype application/pdf

By organisation
Faculty of Economic Sciences, Communication and IT
Information Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 995 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 314 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf