# Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
## 1 Introduction
Most of previous studies [10; 11; 12; 13; 14; 15] have employed the carving technique that searches exhaustedly artifacts of deleted files upon unallocated storage space of camera systems. For more efficient searching operation, some of them [13; 14; 15] utilized a specific unique header and a footer signature of deleted data format. This signature-based carving approach searches for the unique signature of still image or video files and extracts the data between the signatures. Recent carving methods [16; 17; 18] considered the case that a deleted file is split into multiple fragments and the fragments are spread in non-continuous locations. They search for spread fragments and combines them into a single file based on the information of fragment size and fragment location in the video file. However, all of these previous methods did not consider the reconstruction of lost creation-times of recovered files. As a branch of hidden data recovery, some previous studies [19; 20; 21; 22; 23] dealt with a problem of reconstructing the creation order, called timeline, of huge events with heterogeneous time-related metadata. These studies focused on designing a framework that automatically generates the timeline  
Figure 1: Example of utilizing creation order. of massive events obtained from different devices. However, they required time-related metadata and thus are not applicable to recovered files without the metadata of creation-time. Only a few studies [24; 25; 26; 27] addressed the automatic timeline reconstruction of files without the metadata of creation-time. They are designed on the basis of the file allocation pattern of file systems. [PERSON] [24] examined a statistical relationship between the file allocation sequence and the file creation-times. This statistical relationship cannot be utilized to reconstruct the deterministic creation order of recovered files, because it provides just non-deterministic probability information for the creation-time. [PERSON] [25] investigated the file allocation pattern of Linux FAT32 file system and revealed that relative positions of files on the storage device are directly related to their creation order. The relationship between file locations and their creation order is utilized to derive the creation-time bound of recovered files. [PERSON] et al. [26] analyzed the complexity of creation order reconstruction for Linux FAT32 file system. These two methods [25; 26] are applicable only to Linux FAT32 file system, but not to Windows FAT32 file system. [PERSON] [27] analyzed characteristics of Windows NTFS file system [15] in order to detect the antedating of files. This method is applicable only to Windows NTFS file system but not to Windows FAT32 file system, while the FAT32 file system is widely deployed in commercial storage devices and popularly used in removable SD flash memory cards. It is the allocator of the file system in a kernel's driver that determines which of storage space each file is allocated to. In this article, we propose a novel method that constructs the creation order of recovered files upon the Windows FAT32 file system. Windows operation systems are adopted by many commercial multimedia devices, for example, Nokia Lumia smart phone, HP Stream tablet, Microsoft Surface tablet, Pupug In-dash navigation, etc. We first examine the file allocation behavior of Windows FAT32 file system through elaborate experiments of recent Windows operation systems such as Windows XP, Windows 7, Windows 8.1, and Windows 10. Next, on the basis of the verified behavior of Windows FAT32 file system, we design a creation order reconstruction method. Creation order of files is established using both the correlation between storage locations of files and their creation order, and the correlation between directory entry order of files and their creation order. The creation order can be utilized to derive the creation-time bound of files recovered without the creation-time information.