# Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
## 2 Background
### Timestamp Transfer on Linking the Connected Devices  
The timestamp rules in NTFS are very complicated and are dependent on both file types and ADS operations [3]. How NTFS sets or updates timestamps depends on the type of lower-level file operations. It involves multiple interactions among the shells, NTFS, applications, and various \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Type** & **Tools** & **Statement** & **Sample** \\ \hline \multirow{6}{*}{Creation} & \multirow{2}{*}{Type or copy} & \multirow{2}{*}{Add data to ADS} & echo “This is another ADS \\  & & & test file”\textgreater{} test.txt:ads.txt \\ \cline{3-4}  & & & type marked.exe \textgreater{} \\  & & & test.txt:ads.exe \\  & & & copy marked.exe \textgreater{} \\  & & & test.txt:ads.exe \\ \cline{3-4}  & \multicolumn{2}{c}{\(>\)} & marked.txt \textgreater{} \\  & & & original.txt:malicious.txt \\ \hline \multirow{6}{*}{List} & \multicolumn{2}{c}{DIR /r} & \multirow{6}{*}{Lists the ADS files} & \multirow{2}{*}{dir/r} \\ \cline{3-4}  & \multicolumn{2}{c}{LADS} & & \\ \cline{3-4}  & \multicolumn{2}{c}{Streams} & & \\ \cline{3-4}  & \multicolumn{2}{c}{AlternateStreamView} & & \\ \hline \multirow{6}{*}{Access, modification or overwriting} & \multirow{2}{*}{Notepad} & Open, modify, or & \multirow{2}{*}{notepad test.txt:ads.txt} \\  & & overwrite images & & \\ \cline{3-4}  & \multicolumn{2}{c}{Start} & & \\ \cline{3-4}  & \multicolumn{2}{c}{Start} & & \\ \cline{3-4}  & \multicolumn{2}{c}{State version} & & \\ \hline Deletion & Echo & Remove ADS file & echo “deleted ADS” \textgreater{} \\  & & & test.txt:ads.exe \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Popular ADS (Alternate Data Stream) techniques. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Analyses**} & \multicolumn{3}{c}{**Techniques**} \\ \cline{2-4}  & **Native** & **Third-Party** \\ \cline{2-4}  & **DOS DIR/r Command** & **LADS, Streams, AlternateStreamView** & **FTK** \\ \hline Differences & A Windows function & ADS detection tools & Forensic toolkit \\ \hline Similarities & All techniques can find and retrieve ADS information in NTFS artifacts  
\end{table} 
Table 3: Comparative analyses in detecting ADS operations. configurations or settings in Windows [23]. Moreover, the SetFileTime function can modify timestamps without changing the file content. The SystemTimeToFileTime function can convert a timestamp to specified file time [24]. Windows API function calls in various configurations or versions will strongly impact how NTFS timestamps are created or updated. Microsoft has documented both NTFS behavior and Windows APIs for various versions [25]. Cybercrime creates a negative impact on societies and creates potential risks for the economy [26]. A digital action taken by a criminal will leave traces of that activity on the system. A timestamp is correctly reflected when something occurs [24]. Even simple operations such as copy and move may be very complicated to change metadata or create artifacts to the system [27]. Viewing the timestamps in an event through the transfer of [PERSON]'s exchange principle can be very helpful in detecting and analyzing these contact artifacts, not only physical but also digital evidence [8]. Timestamps show the time status of a particular digital file. In 2008, [PERSON] proposed to create a system model by listing possible action sequences and their timestamp orders [5]. In 2011, [PERSON], [PERSON], and [PERSON] analyzed the change in temporal attributes with file operations [3]. In 2020, [PERSON] and [PERSON] examined the reliability of artifacts to detect timestamp operations in the NTFS file system [1]. Capturing some contact artifacts in multiple interactions can help practitioners collect digital evidence effectively and generate interesting insights, which lead to a better understanding of criminal behavior [28]. It is possible to link the timestamp transfer to former operations, correlate behavior activities, and identify a suspect during a digital investigation [29].