{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:12:24Z","timestamp":1750219944875,"version":"3.41.0"},"reference-count":21,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2023,9,30]],"date-time":"2023-09-30T00:00:00Z","timestamp":1696032000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2023,9,30]]},"abstract":"<jats:p>\n            The number of\n            <jats:bold>Child Sexual Abuse Material (CSAM)<\/jats:bold>\n            cases has increased dramatically in recent years. This leads to the need to automate various steps in digital forensic processing, especially for CSAM investigations. For instance, if CSAM pictures are found on a device, the investigator aim at finding traces about the origin and possible further dissemination, respectively. In this article, we address this challenge with respect to the widespread Windows operating system. We model different common scenarios of system use by CSAM offenders in the scope of file inbound and outbound transfer channels. This gives us insights about digital traces in the Windows operating system and its applications to get knowledge about origin and possible destination of a file. We review available concepts and applications to support this issue. Furthermore, we develop a recursive-based approach and provide a prototype as plugin for the open source application Autopsy. We call our prototype\n            <jats:italic>AutoTrack<\/jats:italic>\n            . Our evaluation against the different models of Windows system usage reveals that Autotrack is superior to existing solutions and provides support for an investigator to find digital traces about the origin and possible further dissemination of files. We publish our AutoTrack plugin and thus provide full reproducibility of our approach.\n          <\/jats:p>","DOI":"10.1145\/3609232","type":"journal-article","created":{"date-parts":[[2023,7,14]],"date-time":"2023-07-14T12:03:29Z","timestamp":1689336209000},"page":"1-17","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Back and Forth\u2014On Automatic Exposure of Origin and Dissemination of Files on Windows"],"prefix":"10.1145","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-1605-3250","authenticated-orcid":false,"given":"Samantha","family":"Klier","sequence":"first","affiliation":[{"name":"University of the Bundeswehr Munich, RI CODE, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8951-5283","authenticated-orcid":false,"given":"Jan","family":"Varenkamp","sequence":"additional","affiliation":[{"name":"Technical University of Darmstadt, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9254-6398","authenticated-orcid":false,"given":"Harald","family":"Baier","sequence":"additional","affiliation":[{"name":"University of the Bundeswehr Munich, RI CODE, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,10,6]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470051"},{"key":"e_1_3_2_3_2","article-title":"Vorstellung der Zahlen kindlicher Gewaltopfer\u2014Auswertung der Polizeilichen Kriminalstatistik 2021","year":"2021","unstructured":"Bundeskriminalamt. 2021. Vorstellung der Zahlen kindlicher Gewaltopfer\u2014Auswertung der Polizeilichen Kriminalstatistik 2021. Retrieved from https:\/\/www.tagesschau.de\/inland\/bka-kriminalstatistik-101.pdf (2021).","journal-title":"https:\/\/www.tagesschau.de\/inland\/bka-kriminalstatistik-101.pdf"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.08.002"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1111\/j.1556-4029.2009.01150.x"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2018.12.004"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecurity49315.2020.9138874"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2018.04.021"},{"key":"e_1_3_2_9_2","article-title":"Mastering the super timeline with log2timeline","author":"Gu\u00f0j\u00f3nsson Kristinn","year":"2010","unstructured":"Kristinn Gu\u00f0j\u00f3nsson. 2010. Mastering the super timeline with log2timeline. SANS Institute (2010).","journal-title":"SANS Institute"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.05.006"},{"key":"e_1_3_2_11_2","first-page":"32","volume-title":"Proceedings of the LegalAIIA@ ICAIL","author":"Henseler Hans","year":"2019","unstructured":"Hans Henseler and Jessica Hyde. 2019. Technology assisted analysis of timeline and connections in digital forensic investigations. In Proceedings of the LegalAIIA@ ICAIL. 32\u201337."},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34997-3_9"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.301022"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.10.002"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICACDOT.2016.7877639"},{"key":"e_1_3_2_16_2","unstructured":"National Center for Missing & Exploited Children (NCMEC). 2021. 2021 CyberTipline Reports by Country. (2021). Retrieved from https:\/\/www.missingkids.org\/gethelpnow\/cybertipline\/cybertiplinedata last accessed 2023-02-06."},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/CAIPT.2017.8320684"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.09.002"},{"key":"e_1_3_2_19_2","unstructured":"Scientific Working Group on Digital Evidence (SWGDE). 2016. SWGDE Digital & Multimedia Evidence Glossary 3.0. (2016)."},{"key":"e_1_3_2_20_2","unstructured":"StatCounter. 2023. Marktanteile der f\u00fchrenden Betriebssysteme weltweit im Januar 2023. (Jan.2023). Retrieved from https:\/\/de.statista.com\/statistik\/daten\/studie\/828610\/umfrage\/marktanteile-der-fuehrenden-betriebssystemversionen-weltweit\/"},{"issue":"1","key":"e_1_3_2_21_2","first-page":"2","article-title":"Technical behaviours of child sexual exploitation material offenders","volume":"17","author":"Steel Chad","year":"2022","unstructured":"Chad Steel, Emily Newman, Suzanne O\u2019Rourke, and Ethel Quayle. 2022. Technical behaviours of child sexual exploitation material offenders. Journal of Digital Forensics, Security and Law 17, 1 (2022), 2.","journal-title":"Journal of Digital Forensics, Security and Law"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2983435"}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609232","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3609232","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:48:58Z","timestamp":1750182538000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3609232"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,30]]},"references-count":21,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,9,30]]}},"alternative-id":["10.1145\/3609232"],"URL":"https:\/\/doi.org\/10.1145\/3609232","relation":{},"ISSN":["2692-1626","2576-5337"],"issn-type":[{"type":"print","value":"2692-1626"},{"type":"electronic","value":"2576-5337"}],"subject":[],"published":{"date-parts":[[2023,9,30]]},"assertion":[{"value":"2023-06-02","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-06-26","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-10-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}