# Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
## 3 Research Design
### Observation Scenario  
This experiment adopts the iterative steps in Appendices A-C to collect data from 23 June to 9 August 2019 and explore timestamp rules. The time zone is UTC (Coordinated Universal Time) for FTK 6.2.1 records. The observation formulates a scenario on experimental objects (cover media). Steganography is the process of hiding confidential data on cover media, which can be divided into two parts [30]: original media and marked media. Original media are visible in Windows Explorer or via the \"dir\" command such as \"F:\(\backslash\)F1,\" \"F:\(\backslash\)T1.txt,\" and \"F:\(\backslash\)W1.doc.\" Marked media, the output of the embedding module, is perceptually identical to original media but with data hidden. In this paper, it is the ADS itself, such as \"F:\(\backslash\)F1:EF-1.txt,\" \"F:\(\backslash\)T1.txt:ET-1.txt,\" and \"F:\(\backslash\)W1.doc:EW-1.txt.\" Based on the ADS commands in Table 5, the inherited variety of cover media is illustrated as _A-A_4 and _B-B_3. All timestamps are recorded and identified in three stages. The observation scenario was designed to find whether there are any timestamp rules in ADS operations. A timestamp order is a logical series of all elements in the stamping time set \(\theta\), where each element is related to the next one in the sequence with the approximately equal relation \"\(\sqsubseteq\),\" the equal relation \"=,\" or the less-than relation \"\(<\).\" The approximately equal relation is anything that is intentionally similar but not exactly equal to something else. The equal relation implies that these timestamps were set at the same time. The less-than relation implies that the first timestamp is earlier than the second. Each object has n different timestamps \(\theta\)1, \(\theta\)2,..., \(\theta\)n. Sequential timestamps also record each step, where n is set to \"27\" in this experiment. The updated timestamps are underlined for comparison in Tables 6-8. These timestamps were set in time t\(\theta\)1, t\(\theta\)2,..., t\(\theta\)n, where the temporal values observed by the researcher are c(t\(\theta\)1), c(t\(\theta\)2),..., c(t\(\theta\)n) [4]. These experimental processes are documented to be repeated or conducted by the practitioner or a third party for obtaining comparable results and evolving the expected findings. In Stage 1 (creation), the researcher first explores the timestamps as the baseline data and gathers its temporal attributes to identify their initial status. The basic notation of an ADS file is \(<\)filename\(>\):\(<\)ADSname\(>\). In Table 6, Stage 1(a) and 1(c) is the file creation on original media. Stage 1(b) and 1(d) are the 1 st ADS creation on marked media. Stage 1(e) is the 2 nd ADS creation on marked media. $SI and $FN-time of original media are created in Stage 1(a)(c). Stage 1(e) updates $SI.M-time of 1 st ADS marked media, which is no content change. It shows the contact artifacts between two marked media in 2 nd ADS creation. $SI.AC-time of marked media is inherited from the original media in Stage 1(b)(d)(e). It shows the contact artifacts in ADS creation operations. Table 6 illustrates the contact artifacts in ADS creation operations and indicates the hidden relations among the following inherited varieties: \(A\) and \(A^{\mathbf{1}}\) in Stage 1(a)(b), \(B\) and \(B^{\mathbf{1}}\) in Stage 1(c)(d), and \(A\) and \(A^{\mathbf{2}}\) in Stage 1(a)(e). In Stage 2 (modification), the researcher investigates the timestamps on original media and 1 st ADS modification on marked media in Table 7. Stage 2(a) updates the $SI.M-time of original media and the $SI.MAC-time of its folder. In Stage 2(b), $SI.EM-time of original media and $SI.M-time of marked media are updated. Moreover, $SI.MAC-time and $FN-time of original media are inherited from Step 1-3 and 13-15 in Stage 2(a).