Detection of Suspicious Timestamps in NTFS using Volume Shadow Copies

When a computer gets involved in crime, it is the mission of digital forensic experts to extract left binary artifacts on that device. Among those artifacts, there may be some volume shadow copy files Windows operating system. Those are snapshots recorded by system case needed restore specific past date. Before this study, we did not know if valuable information hold within snapshot can exploited locate suspicious timestamps an NTFS formatted partition. This study provides reader with inter-snapshot time analysis for detecting file timestamp manipulation. In other words, will leverage presence multiples copies detect any tampering timestamps. A detection algorithm contributed. Its main role assist investigator spot manipulation has occurred. addition, virtual environment been set up validate use proposed detection.