{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T11:06:40Z","timestamp":1776078400702,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":17,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,8,29]],"date-time":"2023-08-29T00:00:00Z","timestamp":1693267200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,8,29]]},"DOI":"10.1145\/3600160.3605027","type":"proceedings-article","created":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T22:54:41Z","timestamp":1691621681000},"page":"1-9","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Reconstructing Timelines: From NTFS Timestamps to File Histories"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-3223-9310","authenticated-orcid":false,"given":"Jelle","family":"Bouma","sequence":"first","affiliation":[{"name":"Open University of the Netherlands, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7958-8921","authenticated-orcid":false,"given":"Hugo","family":"Jonker","sequence":"additional","affiliation":[{"name":"Open University of the Netherlands, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-6251-9742","authenticated-orcid":false,"given":"Vincent","family":"van der Meer","sequence":"additional","affiliation":[{"name":"Zuyd University of Applied Science, Open University of the Netherlands, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-5986-0180","authenticated-orcid":false,"given":"Eddy","family":"Van Den Aker","sequence":"additional","affiliation":[{"name":"Zuyd University of Applied Science, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,8,29]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Analysis of Time Information for Digital Investigation. In International Conference on Networked Computing and Advanced Information Management (NCM\u201909)","author":"Bang Jewan","year":"2009","unstructured":"Jewan Bang, Byeongyeong Yoo, Jongsung Kim, and Sangjin Lee. 2009. Analysis of Time Information for Digital Investigation. In International Conference on Networked Computing and Advanced Information Management (NCM\u201909), Fifth International Joint Conference on INC, IMS and IDC: INC 2009: International Conference on Networked Computing, IMS 2009: International Conference on Advanced Information Management and Service, IDC 2009: International Conference on Digital Content, Multimedia Technology and its Applications, Seoul, Korea, August 25-27, 2009. IEEE Computer Society, 1858\u20131864."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.12.001"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2004.10.002"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.11.003"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/IMIS.2014.92"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/3273390.3273392"},{"key":"e_1_3_2_1_7_1","first-page":"31","article-title":"Data Hiding in NTFS Timestamps for Anti-Forensics","volume":"8","author":"Cho Gyu-Sang","year":"2016","unstructured":"Gyu-Sang Cho. 2016. Data Hiding in NTFS Timestamps for Anti-Forensics. International Journal of Internet, Broadcasting and Communication 8, 3 (2016), 31\u201340.","journal-title":"International Journal of Internet, Broadcasting and Communication"},{"key":"e_1_3_2_1_8_1","volume-title":"The Rules of Time on NTFS File System. In Second International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE\u201907)","author":"Chow Kam-Pui","unstructured":"Kam-Pui Chow, Michael Y.\u00a0K. Kwan, Frank Y.\u00a0W. Law, and Pierre K.\u00a0Y. Lai. 2007. The Rules of Time on NTFS File System. In Second International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE\u201907). IEEE Computer Society, 71\u201385."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1982185.1982227"},{"key":"e_1_3_2_1_10_1","volume-title":"Time for Truth: Forensic Analysis of NTFS Timestamps. In 16th International Conference on Availability, Reliability and Security (ARES\u201921)","author":"Galhuber Michael","year":"2021","unstructured":"Michael Galhuber and Robert Luh. 2021. Time for Truth: Forensic Analysis of NTFS Timestamps. In 16th International Conference on Availability, Reliability and Security (ARES\u201921). ACM, 44:1\u201344:10."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.12.001"},{"key":"e_1_3_2_1_12_1","volume-title":"17th IEEE International Conference on Information Reuse and Integration (IRI\u201916)","author":"Ahn Gail-Joon","year":"2016","unstructured":"Dae-il Jang, Gail-Joon Ahn, Hyunuk Hwang, and Kibom Kim. 2016. Understanding Anti-forensic Techniques with Timestamp Manipulation (Invited Paper). In 17th IEEE International Conference on Information Reuse and Integration (IRI\u201916). IEEE Computer Society, 609\u2013614."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301476"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2021.301309"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.300920"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.009"},{"key":"e_1_3_2_1_17_1","volume-title":"4th Annual IFIP WG 11.9 Conference on Digital Forensics (Digital Forensics\u201908)(IFIP, Vol.\u00a0285)","author":"Willassen Svein\u00a0Yngvar","unstructured":"Svein\u00a0Yngvar Willassen. 2008. Hypothesis-Based Investigation of Digital Timestamps. In 4th Annual IFIP WG 11.9 Conference on Digital Forensics (Digital Forensics\u201908)(IFIP, Vol.\u00a0285). Springer, 75\u201386."}],"event":{"name":"ARES 2023: The 18th International Conference on Availability, Reliability and Security","location":"Benevento Italy","acronym":"ARES 2023"},"container-title":["Proceedings of the 18th International Conference on Availability, Reliability and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605027","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3600160.3605027","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:16Z","timestamp":1750182556000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605027"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,29]]},"references-count":17,"alternative-id":["10.1145\/3600160.3605027","10.1145\/3600160"],"URL":"https:\/\/doi.org\/10.1145\/3600160.3605027","relation":{},"subject":[],"published":{"date-parts":[[2023,8,29]]},"assertion":[{"value":"2023-08-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}