# Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
## 1 Introduction  
Even though a file is deleted intentionally or systematically, the deleted file remains in the storage space until new files overwrite its storage space. When a deleted file is recovered from the storage space, the time information in the metadata of a recovered file is occasionally unavailable or incorrect. The recovered file without the metadata of creation-time may lose the useful information when the files were generated. When it is suspected that a recovered file is associated with crimes or frauds, the creation-time of the recovered file plays an important role in digital forensics, i.e., verifying whether the recovered file was created before or after target criminals. Especially, the creation-time is very important for recovered multimedia files because still images or video files frequently contain critical scenes providing crucial evidence for criminal investigation and accident site examinations. The creation-time of recovered multimedia files verifies exactly when the recorded critical scenes occurred, and whether or not the recorded critical scenes are related to target criminals and accidents. While many studies for detecting the forged document, identifying the source digital device of multimedia, and recovering deleted files have been done [1; 2; 3], a little progress has been done for creation-time reconstruction of files recovered without the metadata of creation-time. In this article, we propose a creation order reconstruction method for recovered files upon the FAT32 file system with Windows operation systems. The creation order of files is utilized to derive the creation-time bound of files recovered without the meta information of creation-time. Figure 1 shows an example of utilizing the creation order of a recovered video file without the time-related meta information. A video file loses its time-related meta information, when its file header containing the creation-time isnot recovered while its video contents are partially recovered, as shown in Figure 1. If the creation order of the recovered file is between file B and file C, the lower bound of its creation-time is 05 May 02:20 and the upper bound is 05 May 02:30. This means that the image scenes in the recovered video file were recorded at later than 05 May 02:20 and earlier than 05 May 02:30. If the creation order of the recovered file is between file X and file Y, the image scenes in the recovered video file were recorded at later than 02 June 04:00 and earlier than 02 June 04:10. Most of related digital forensic studies focused on multimedia tamper detection, source camera identification, or hidden data recovery [1; 2; 3]. The previous studies for the multimedia tamper detection can be classified into two groups: active intrusive approach and passive blind approach. In the active intrusive approach, a known identifier trace such as a signature or watermark is embedded imperceptibly into the multimedia contents at the time of recording and it is utilized to discover tampering evidence of the forged multimedia [4]. In the passive blind approach, descriptive features such as camera sensor artifacts, coding artifacts, and material object features are extracted from the multimedia data without help of signatures or watermarks and they are analyzed to detect abnormal patterns of forged multimedia [5; 6]. The previous studies for the source camera identification investigated unique characteristics of digital devices such as lens radial distortion, sensor imperfections, color filter array interpolation, codec parameters, etc. in order to identify the specific model of source digital devices [1; 7; 8]. Our study belongs to the category of hidden data recovery. The previous studies for the hidden data recovery investigated how to search and extract artifacts of deleted data upon unallocated storage space of camera devices and how to assemble found fragments [3; 9].