Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.Ī new phenomenon, which increasingly rises among the young generation all over the world, is Internet addiction.

We also found that the contents of resident and non-resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them.

The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Our experiments used four file-wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. This paper presents forensic analysis of anti-forensic file-wiping tools on the Windows platform.

What do the passes mean on privazer