Uthoff J, Dreier LM, Lambertz M, Rybalka M, Freiling F (2025)
Publication Type: Journal article
Publication year: 2025
Book Volume: 54
Article Number: 301986
DOI: 10.1016/j.fsidi.2025.301986
Digital stratigraphic methods aim to infer new information about digital objects using their depositional context. Many such methods have been developed, for example, to interpret file allocation traces and thereby estimate timestamps of file fragments based on their position on disk. Such methods are difficult to compare. We therefore present a corpus of NTFS file system images that can be used to evaluate these methods. The corpus comprises different categories, each extensively employing a small subset of file system operations to display their effect on file allocation traces. We demonstrate the usefulness of this corpus by evaluating the method of Bahjat and Jones (2019) that derives the timestamp of a file fragment from the timestamps of neighboring files. The corpus was generated using a revised version of fsstratify, a software framework to simulate file system usage. The tool is able to log the position of content data during file creation, greatly facilitating research in the realm of digital stratigraphy.
APA:
Uthoff, J., Dreier, L.M., Lambertz, M., Rybalka, M., & Freiling, F. (2025). Creating a standardized corpus for digital stratigraphic methods with fsstratify. Forensic Science International: Digital Investigation, 54. https://doi.org/10.1016/j.fsidi.2025.301986
MLA:
Uthoff, Julian, et al. "Creating a standardized corpus for digital stratigraphic methods with fsstratify." Forensic Science International: Digital Investigation 54 (2025).
BibTeX: Download