# Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
###### Abstract  
When computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, and intelligence agents to erase, tamper, or conceal secrets. However, ADS problems are much ignored in digital forensics. Rare researches illustrated the contact artifacts of ADS timestamps. This paper performs a sequence of experiments from an inherited variety and provides an in-depth overview of timestamp transfer on data hiding operations. It utilizes files or folders as original media and uses the timestamp rules as an investigative approach for the forensic exchange analysis of file sets. This paper also explores timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts. The experiment results demonstrate the effectiveness of temporal attributes, help digital forensic practitioners to uncover hidden relations, and trace the contact artifacts among crime scenes, victims, and suspects/criminals.  
data hiding; temporal attributes; timestamp transfer; exchange principle; trace evidence; contact artifacts; crime scene reconstruction; cybercrime investigation; digital forensics +
Footnote †: journal:  
It is thus very critical that practitioners are highly sensitive to exploring any user timestamp behaviors. This paper considers the forensic exchange analysis task: This context performs ADS operations and discovers their timestamp rules. The researcher tests this by using two controlled experiments [10]:  
* A discovery experiment (Section 3.3) to repeatedly classify temporal attributes as timestamp rules.
* An ADS experiment analogous to [PERSON] and [PERSON] in 2017 [11] as conducting comparative analyses in Case 2 (Section 5.2).  
Practitioners with knowledge and expertise play an unquestionably critical role in identifying divisible evidence and collecting any temporal attributes from the crime scene [12]. The existence of trace evidence is not unique to physical evidence. Linking the digital evidence of contact artifacts is critical to discover other connected devices [13]. This paper aims to address short-term changes in ADS behavioral relationships by performing a temporal dissection of classification. It provides a first step towards uncovering hidden behavioral changes via temporal dissection of contact artifacts [14]. The uniqueness and contributions of this paper are listed below:  
* Perform a sequence of experiments to explore the contact artifacts of timestamp transfer.
* Analyze temporal attributes and propose some timestamp rules from ADS operations.
* Uncover hidden relations using timestamp rules from an inherited variety.
* Support practitioners to explore any possible contact artifacts in connected devices.
* Evaluate the efficacy of several temporal values to reconstruct an event.
* Provide an in-depth overview of timestamp transfer on data hiding operations from a forensic exchange analysis perspective.  
This paper is organized as follows. In Section 2, background information is given that shall help to understand the forensic exchange analysis on data hiding timestamps. The divisible matters in temporal attributes give insights into the contact artifacts of ADS operations. The experimental environment, forensic process plan, and observation scenario are presented in Section 3. Section 4 describes the proposed timestamp rules from the following viewpoints: direct analysis on original media (temporal reconstruction), cross-sectional analysis of timestamp orders (relational reconstruction), ADS operation analysis on cover media (functional reconstruction), and analysis results of file sets. The forensic exchange analysis of two case samples is illustrated in Section 5. The conclusions are given in Section 6.