<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-02534606</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-14T05:52:17+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Analyzing Windows Subsystem for Linux Metadata to Detect Timestamp Forgery</title>
            <author role="aut">
              <persName>
                <forename type="first">Bhupendra</forename>
                <surname>Singh</surname>
              </persName>
              <email type="md5">16adc25456e3a50082d178ab36482c05</email>
              <email type="domain">gmail.com</email>
              <idno type="idhal" notation="numeric">1067595</idno>
              <idno type="halauthorid" notation="string">1342757-1067595</idno>
              <affiliation ref="#struct-1005440"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Gaurav</forename>
                <surname>Gupta</surname>
              </persName>
              <idno type="halauthorid">1078377-0</idno>
              <affiliation ref="#struct-481139"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2020-04-07 10:37:23</date>
              <date type="whenModified">2020-04-07 10:42:36</date>
              <date type="whenReleased">2020-04-07 10:42:36</date>
              <date type="whenProduced">2019-01-28</date>
              <date type="whenEndEmbargoed">2022-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-02534606v1/document">
                <date notBefore="2022-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-02534606v1/file/488399_1_En_9_Chapter.pdf" id="file-2534606-2404007">
                <date notBefore="2022-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-02534606</idno>
            <idno type="halUri">https://inria.hal.science/hal-02534606</idno>
            <idno type="halBibtex">singh:hal-02534606</idno>
            <idno type="halRefHtml">&lt;i&gt;15th IFIP International Conference on Digital Forensics (DigitalForensics)&lt;/i&gt;, Jan 2019, Orlando, FL, United States. pp.159-182, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-030-28752-8_9"&gt;&amp;#x27E8;10.1007/978-3-030-28752-8_9&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">15th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2019, Orlando, FL, United States. pp.159-182, &amp;#x27E8;10.1007/978-3-030-28752-8_9&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-2534606-2404007"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-WG" corresp="IFIP">Working Groups</idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-DF" corresp="IFIP-LNCS">IFIP-DF</idno>
            <idno type="stamp" n="IFIP-WG11-9" corresp="IFIP-WG">IFIP-WG11-9</idno>
            <idno type="stamp" n="IFIP-AICT-569" corresp="IFIP-AICT">Advances in Digital Forensics XV</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 3: Filesystem Forensics</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Analyzing Windows Subsystem for Linux Metadata to Detect Timestamp Forgery</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Bhupendra</forename>
                    <surname>Singh</surname>
                  </persName>
                  <email type="md5">16adc25456e3a50082d178ab36482c05</email>
                  <email type="domain">gmail.com</email>
                  <idno type="idhal" notation="numeric">1067595</idno>
                  <idno type="halauthorid" notation="string">1342757-1067595</idno>
                  <affiliation ref="#struct-1005440"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Gaurav</forename>
                    <surname>Gupta</surname>
                  </persName>
                  <idno type="halauthorid">1078377-0</idno>
                  <affiliation ref="#struct-481139"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>15th IFIP International Conference on Digital Forensics (DigitalForensics)</title>
                  <date type="start">2019-01-28</date>
                  <date type="end">2019-01-29</date>
                  <settlement>Orlando, FL</settlement>
                  <country key="US">United States</country>
                </meeting>
                <editor>Gilbert Peterson</editor>
                <editor>Sujeet Shenoi</editor>
                <imprint>
                  <publisher>Springer International Publishing</publisher>
                  <biblScope unit="serie">Advances in Digital Forensics XV</biblScope>
                  <biblScope unit="volume">AICT-569</biblScope>
                  <biblScope unit="pp">159-182</biblScope>
                  <date type="datePub">2019</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-030-28752-8_9</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">forgery</term>
                <term xml:lang="en">timestamps</term>
                <term xml:lang="en">Windows Subsystem for Linux</term>
                <term xml:lang="en">Anti-forensics</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Timestamp patterns assist forensic analysts in detecting user activities, especially operations performed on files and folders. However, the Windows Subsystem for Linux feature in Windows 10 versions 1607 and later enables users to access and manipulate NTFS files using Linux command-line tools within the Bash shell. Therefore, forensic analysts should consider the timestamp patterns generated by file operations performed using Windows command-line utilities and Linux tools within the Bash shell.This chapter describes the identification of timestamp patterns of various file operations in stand-alone NTFS and Ext4 filesystems as well as file interactions between the filesystems. Experiments are performed to analyze the anti-forensic capabilities of file timestamp changing utilities – called timestomping tools – on NTFS and Ext4 filesystems. The forensic implications of timestamp patterns and timestomping are also discussed.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
              <org type="consortium">WG 11.9</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-1005440" status="VALID">
          <idno type="ROR">https://ror.org/01f8qyw75</idno>
          <orgName>Indian Institute of Information Technology [Pune]</orgName>
          <desc>
            <address>
              <addrLine>Near Bopdev Ghat, Kondhwa Annexe, Yewalewadi, Pune, Maharashtra 411048,</addrLine>
              <country key="IN"/>
            </address>
            <ref type="url">http://www.iiitp.ac.in/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-481139" status="VALID">
          <orgName>Ministry of Information Technology [New Delhi]</orgName>
          <date type="start">2017-01-30</date>
          <desc>
            <address>
              <country key="IN"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>