# Extraction of Creation-Time for Recovered Files on Windows FAT32 File System
## 5 Conclusions and Discussions
In Figure 6, the creation-time of file B is earlier than that of file H. Also the creation-time of file G is earlier than that of file I. If there are  
\[(\cdots,?_{i},\cdots,?_{i+1},\cdots,?_{i+2},\cdots)\;*\;(\cdots,X^{i},?^{i+1}_{ j},Y^{i+2},\cdots)\]  
in the file creation event sequence and  
\[[\cdots X,*_{a},?_{b},Y,\cdots]\]  
in the file allocation sequence, then \(?^{i+1}_{j}\) is a candidate of creation event only for the file recovered from \(*_{a}\) or \(?_{b}\), but not for the other recovered files. If there is  
\[(\cdots,?_{i},\cdots,?_{i+1},\cdots,?_{i+2},\cdots)\;*\;(\cdots,X^{i},?^{i+1}_ {j},Y^{i+2},\cdots)\]  
in the file creation event sequence, then \(X^{i}\), \(?^{i+1}_{j}\) and \(Y^{i+2}\) are continuous file creation events. Suppose the file for \(?^{i+1}_{j}\) is allocated to some clusters except between the beginning of file X and the end of file Y. Then the file allocation start point indexed by the FSI_Nxt_Free field must be decreasedduring the allocation of files \(X^{i}\), \(\gamma^{i+1}_{j}\) and \(Y^{i+2}\), because the file allocator operates according to the Deletion-backward Next Fit algorithm. This means that there is a deletion operation after the creation event of \(X^{i}\) and before the creation event of \(\gamma^{i+1}_{j}\). Allocations of \(\gamma^{i+1}_{j}\) and file \(Y^{i+2}\) result in  
\[[\cdots,X]\;[Y,\cdots]\;\;\text{or}\;\;[\cdots,X,Y,\cdots]\]  
in the file allocation sequence. It is impossible to result in \([\cdots,X,*_{a},?_{b},Y,\cdots]\) in the file allocation sequence. Consequently, \(\gamma^{i+1}_{j}\) cannot be a creation event of other deleted files located besides \(*_{a}\) and \(?_{b}\). **Property A3**: _: If there are_  
\[(\cdots,X,?_{j},Y,\cdots)\]  
_without? behind \(Y\) in the file creation event sequence and_  
\[[\cdots,X,?_{a},Y,\cdots]\]  
_without? (or \(*\)) behind \(Y\) in the file allocation sequence, then \(?_{j}\) is the creation event of the file recovered from \(?_{a}\)._  
**Proof. ** If there is  
\[(\cdots,X,?_{j},Y,\cdots)\]  
in the file creation event sequence, then \(X\), \(?_{j}\) and \(Y\) are continuous file creation events. If there is no? behind \(Y\) in the file creation event sequence and there is no? (or \(*\)) in the file allocation sequence, then there is no deletion operation after creation of file \(Y\). Suppose \(?_{j}\) is a creation event of some deleted file located besides \(?_{a}\). When there is no deletion operation after creation of file \(Y\), some \(?_{i}\) earlier than \(?_{j}\) must be a creation event of the file located in \(?_{a}\). For continuous file creation events \(X\), \(?_{j}\) and \(Y\), \(?_{i}\) is earlier than the creation event of file X. Only when the file allocation start point is decreased immediately after \(?_{i}\), \(?_{i}\) located in \(?_{a}\) makes the file allocation form \([\cdots,?_{a},Y,\cdots]\) according to the Deletion-backward Next Fit algorithm. In the other cases, \(?_{i}\) located in \(?_{a}\) makes the file allocation form \([\cdots,?_{a},\cdots,Y,\cdots]\). When the tail file \(?_{i}\) is deleted, the clusters assigned to the tail file are fully available hereafter for further file allocations. That is, the Deletion-backward Next Fit algorithm deals with the clusters assigned to the deleted tail file like as the tail file is never allocated. Also the file allocator start point must be decreased after the creation event of \(X\) and before the creation event of \(?_{j}\), because \(?_{j}\) later than \(?_{i}\) is a creation event of some deleted file located besides \(?_{a}\). Allocations of \(?_{j}\) and file \(Y\) result in  
\[[\cdots,X,Y,\cdots]\;\;\text{or}\;\;[\cdots,X]\;[Y,\cdots]\]  
in the file allocation sequence, because the file allocator operates like as the tail file \(?_{i}\) is never allocated. It is impossible to result in \([\cdots,X,?_{a},Y,\cdots]\) in the file allocation sequence. Consequently, some \(?_{i}\) earlier than \(?_{j}\) cannot be a creation event of the file located in \(?_{a}\). Also there is no? after creation of file \(Y\).