# Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
## 5 Discussions and Analyses on Case Examples
### Case 2
When users delete the ADS from Word/text files, the $SLE-time is updated in Step C6. Even though the user has different operations, their timestamp rules are the same situations with Rule 2 (modification or overwriting).
* Rule 3. Creating data (text, Word, PE, and jpg file) into the ADS of Word/text file will update the $SI.EM-time of original media in Step C2 and C4. Showing the actual file content becomes essential to identify their former ADS operations (creation, modification, or overwriting). * Rule 6. Extracting the ADS from Word/text file will keep any timestamps unchanged in Step C5 and C6. The $SI timestamp order on original media (Rule 6) still holds.
2. Uncovering hidden relations in an inherited variety (RQ 2)  
There are various ways a criminal can commit his crime or conceal his data. The researcher can still uncover hidden relations and predict where the contact artifacts of inherited variety will be located. The inherited variety can be the evidence dynamics of contact artifacts. Criminals are exploiting the convenience and anonymity of modern technologies to commit a diverse range of criminal activities. The researcher also analyzes the available evidence to looks for the presence of the predicted artifacts. However, some of the criminal operations are out of the scope of this paper. For example, Tables 12 and 13 illustrates the temporal values of $SI.AC-time and $FN.time in Step C4-C6 (\(W^{2}\)-\(W^{8}\) and \(T^{2}\)-\(T^{8}\)) are inherited from Step C3 (\(W^{2}\) and \(T^{2}\)).  
Moreover, the researcher also uses IBM i2 Analyst's Notebook to analyze Tables 12 and 13 and discovers the visual contacts in Figure 6, which facilitate the relational reconstruction from the contact artifacts of temporal values. Figure 6a illustrates its original status. Figure 6b further removes the centralized \(W^{2}\) to reduce the noise data and merges the related entities to provide a reduced view of information. Some divisible temporal attributes of contact artifacts happen below:  
* W1 is inherited from W.  
* W\({}^{7}\) is inherited from W\({}^{6}\).
* W\({}^{8}\) is inherited from W\({}^{4}\).
* T\({}^{2}\) and T\({}^{1}\) are inherited from T.
* T\({}^{7}\) and T\({}^{8}\) are inherited from T\({}^{6}\).  
(3) Tracing the contact artifacts of cover media (RQ 3)  
Figure 6: Relational reconstruction from the contact artifacts of temporal values (Case 2).  
The temporal attributes of digital files can exactly verify whether or not crimes are related to suspects and victims [37]. Practitioners can trace the contact artifacts of cover media. Practitioners can explore timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts [13]. After repeating these similar experiments, the researcher finds that: There is a c(t66) typ [11] in Step C3.2 since the researcher cannot find any former relation in Step C1.1 ($SI.M-time \(\
eq 1^{\prime}\)). Moreover, [PERSON] and [PERSON] also have expressed that file decompression is similar to file creation, and $SI.M-time remains unchanged in Step C3 [11]. Then, the researcher can know that the temporal value c(t66) is equal to c(t65). It means that the user decompresses the Word/text file at the same time c(t65) in Step C3. The correct temporal value in Step C3.2 is illustrated in Table 13. This kind of evidence can be handled through file metadata or other sources to recreate events. For example, the value of $SI.M-time in Step C6.1, c(t69), shows that its source file is created from Step C4.3 (Table 12). Moreover, different file types or operations have their unique update timestamp patterns in Step C3. For instance, decompressing Word files will update their $SI.EAC-time and $FN-time. However, all timestamps of original media keep unchanged in decompressing.txt files.