NCJ Number
239623
Journal
Journal of Forensic Sciences Volume: 57 Issue: 1 Dated: January 2012 Pages: 103-107
Date Published
January 2012
Length
5 pages
Annotation
This article examines the transfer of data files to CD or DVD.
Abstract
When theft of a physical item occurs it is detectable by the fact that the object is missing, however, when the theft of a digital item occurs it can go unnoticed as exact replicas can be created. The original file is left intact but valuable information has been absconded. One of the challenges facing digital forensic examiners is detecting when files have been copied off of a computer system in some fashion. While certain methods do leave residual evidence behind, CD Burning has long been held as a copying method that cannot be identified. Through testing of the burning process and close examination of the New Technology File System (NTFS), artifacts from the master file table in the various versions of Microsoft Windows, markers have been found that are associated with copying or "burning" files to CD or DVD. Potential evidence that was once overlooked may now be detectable. Published by arrangement with John Wiley & Sons.