{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T19:19:34Z","timestamp":1782760774708,"version":"3.54.5"},"reference-count":27,"publisher":"Association for Computing Machinery (ACM)","issue":"4","funder":[{"DOI":"10.13039\/501100001659","name":"Deutsche Forschungsgemeinschaft","doi-asserted-by":"crossref","award":["393541319\/GRK2475\/2-2024"],"award-info":[{"award-number":["393541319\/GRK2475\/2-2024"]}],"id":[{"id":"10.13039\/501100001659","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2025,12,31]]},"abstract":"<jats:p>\n                    Despite many advances in automatic exercise generation tools in digital forensics, many disk images for training and education are still manually created. The resulting disk images are commonly useful, but often need to be adapted because of the need to scrub artifacts of the generation process or adapt file contents or timestamps for evidence individualization. Since common forensics tools do not allow easy editing of evidence, we present DiskForge, an extensible framework for performing small changes to disk images in educational circumstances. DiskForge combines the typical parsing functionalities from disk forensics tools and combines them with the option to update and edit structures within the disk. To demonstrate the applicability of DiskForge, we instantiate the framework for the use case of\n                    <jats:italic toggle=\"yes\">timestomping<\/jats:italic>\n                    , i.e., changing timestamps in file system metadata, log files, and SQLite databases. For each of these instances, we demonstrate the new level of\n                    <jats:italic toggle=\"yes\">ease<\/jats:italic>\n                    and\n                    <jats:italic toggle=\"yes\">precision<\/jats:italic>\n                    for timestamp manipulation on disk images. Our evaluation, however, also highlights the fragile nature of timestamp interpretation in current forensic tooling, and ultimately that creating perfect forgeries is harder than merely changing bits on disk.\n                  <\/jats:p>","DOI":"10.1145\/3748265","type":"journal-article","created":{"date-parts":[[2025,8,25]],"date-time":"2025-08-25T13:50:47Z","timestamp":1756129847000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["DiskForge: Timestomping on Disk Images for Educational Benefit"],"prefix":"10.1145","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-0189-7409","authenticated-orcid":false,"given":"Niclas","family":"Pohl","sequence":"first","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Erlangen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-8409-2136","authenticated-orcid":false,"given":"Lena L.","family":"Voigt","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Erlangen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1088-8302","authenticated-orcid":false,"given":"Christopher","family":"Hargreaves","sequence":"additional","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-5073-6972","authenticated-orcid":false,"given":"Christofer","family":"Fein","sequence":"additional","affiliation":[{"name":"Hochschule Niederrhein, Krefeld, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8279-8401","authenticated-orcid":false,"given":"Felix","family":"Freiling","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Erlangen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,12,15]]},"reference":[{"key":"e_1_3_3_1_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.PROCS.2019.11.011"},{"key":"e_1_3_3_2_2","doi-asserted-by":"publisher","DOI":"10.5555\/1051914"},{"key":"e_1_3_3_3_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.11.003"},{"key":"e_1_3_3_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2021.301133"},{"key":"e_1_3_3_5_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2009.06.016"},{"key":"e_1_3_3_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.DIIN.2018.01.014"},{"key":"e_1_3_3_7_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301344"},{"key":"e_1_3_3_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.DIIN.2017.06.004"},{"key":"e_1_3_3_9_2","doi-asserted-by":"publisher","DOI":"10.1002\/9781118689196.ch6"},{"key":"e_1_3_3_10_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2023.301679"},{"key":"e_1_3_3_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.05.006"},{"key":"e_1_3_3_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2025.301864"},{"key":"e_1_3_3_13_2","unstructured":"Mike Hartley and Romain Dumont. 2020. Indicator Removal: Timestomp. Retrieved March 14 2024 from https:\/\/attack.mitre.org\/versions\/v15\/techniques\/T1070\/006\/"},{"key":"e_1_3_3_14_2","article-title":"The use of digital forensic case studies for teaching and assessment","author":"Lallie Harjinder Singh","year":"2010","unstructured":"Harjinder Singh Lallie. 2010. The use of digital forensic case studies for teaching and assessment. In 4th International Conference on Cybercrime Forensics Education and Training, Canterbury Christchurch University.","journal-title":"4th International Conference on Cybercrime Forensics Education and Training"},{"key":"e_1_3_3_15_2","unstructured":"Wicher Minnaard. 2014. Timestomping NTFS. M.Sc. Final Research Project Report. University of Amsterdam. Retrieved April 21 2024 from https:\/\/www.os3.nl\/_media\/2013-2014\/courses\/rp2\/p48_report.pdf"},{"key":"e_1_3_3_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/IMF.2009.8"},{"key":"e_1_3_3_17_2","unstructured":"OffSec. 2024. Metasploit Unleashed\u2014TimeStomp. Retrieved March 24 2024 from https:\/\/www.offsec.com\/metasploit-unleashed\/timestomp\/"},{"key":"e_1_3_3_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3395644"},{"key":"e_1_3_3_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.300920"},{"key":"e_1_3_3_20_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.01.010"},{"key":"e_1_3_3_21_2","unstructured":"Joakim Schicht. 2014. GitHub\u2014jschicht\/SetMace: Manipulate Timestamps on NTFS\u2014github.com. Retrieved April 12 2024 from https:\/\/github.com\/jschicht\/SetMace"},{"key":"e_1_3_3_22_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.FSIDI.2022.301334"},{"key":"e_1_3_3_23_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.FSIDI.2020.300924"},{"key":"e_1_3_3_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3712716.3712727"},{"key":"e_1_3_3_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20125-2_14"},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2024.301805"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2023.301690"}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3748265","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,15]],"date-time":"2025-12-15T17:57:18Z","timestamp":1765821438000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3748265"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,15]]},"references-count":27,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,12,31]]}},"alternative-id":["10.1145\/3748265"],"URL":"https:\/\/doi.org\/10.1145\/3748265","relation":{},"ISSN":["2692-1626","2576-5337"],"issn-type":[{"value":"2692-1626","type":"print"},{"value":"2576-5337","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,15]]},"assertion":[{"value":"2025-05-11","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-07-07","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}