NDLI: Implications of Microsoft Vista operating system for computer forensics investigations

Content Provider	IEEE Xplore Digital Library
Author	Hayes, D.R. Qureshi, S.
Copyright Year	2009
Description	Author affiliation: Pace University, New York, 10038 USA (Hayes, D.R.)
Abstract	With the growing importance of computer-related evidence today, it is important for law enforcement, prosecutors and computer forensics investigators to understand changes in their technical environment that are impacting the discovery and nature of evidence. Microsoft's Vista (“Vista”) is one change that has brought new challenges for digital investigations, particularly relating to new mechanisms of encryption and general security. This paper will identify those challenges and prescribe possible solutions. More specifically this research proposes practical ways in which the digital investigator can retrieve critical file metadata, explore file systems and record log files. The focus of this paper will be on the changes to Microsoft's New Technology File System (NTFS). In general, Vista has placed a greater emphasis on file sharing across the Internet so XML file formats are more pervasive. Security, and more specifically encryption, is more prevalent in Vista and so this paper will focus on changes to Windows Mail. Although there is no empirical evidence, it appears as though prosecutors heavily rely on electronic mail evidence. With the continuous expansion in size of flash memory, it was imperative to note changes to the digital footprint left by USB thumbdrives as well as the impact of Microsoft's new volatile memory expansion tool - readyboost. Log files are also a crucial source of evidence in computer forensics investigations and these are discussed in great detail as changes in Vista have changed the nature of this evidence. This research paper will discuss the relevance of changes to evidence in Vista by highlighting the use of certain evidentiary files in court cases. Finally, the implications of changes brought about by Vista will be made apparent through experiments conducted with bit-stream imaging tools utilized by law enforcement and other computer forensics examiners. Vista has notable implications for computer forensics investigations. However, this research will prepare the digital investigator for the transition to the Vista operating system and the transformation of digital evidence associated with this new platform.
Starting Page	1
Ending Page	9
File Size	225453
Page Count	9
File Format	PDF
ISBN	9781424423477
DOI	10.1109/LISAT.2009.5031562
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-05-01
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Operating systems Forensics Law enforcement Cryptography File systems Focusing Peer to peer computing Internet XML Security Computer Security Vista Operating System Computer Forensics
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

A framework for computer forensics investigations involving Microsoft Vista

Digital evidence search kit

Vista event log file parsing based on XML technology

Applying XML Signature and XML Encryption to Peer-to-Peer Platform Security

Evidence handling in proactive cyberstalking investigations: the PAPA approach

The impact of Microsoft's Windows 7 on computer forensics examinations

Forensic entropy analysis of microsoft windows storage volumes

A Trusted Platform Module Based Anti-Forensics System

Towards a forensic-aware file system

Implications of Microsoft Vista operating system for computer forensics investigations

Similar Documents

A framework for computer forensics investigations involving Microsoft Vista

Digital evidence search kit

Vista event log file parsing based on XML technology

Applying XML Signature and XML Encryption to Peer-to-Peer Platform Security

Evidence handling in proactive cyberstalking investigations: the PAPA approach

The impact of Microsoft's Windows 7 on computer forensics examinations

Forensic entropy analysis of microsoft windows storage volumes

A Trusted Platform Module Based Anti-Forensics System

Towards a forensic-aware file system

Implications of Microsoft Vista operating system for computer forensics investigations