Quick-Formatted NTFS Drive and a Disputed Creation Time
An external 1 TB NTFS drive is seized from a small accounting office after an employee reports that invoice PDFs disappeared. The drive was quick-formatted on 2 June at 16:18, and about 2.1 GB of new files were copied onto it afterward. The examiner creates a verified image and loads it in a forensic suite. The $MFT contains 284,000 entries, but only 1,200 are marked as deleted. The $LogFile is 64 MB and the $UsnJrnl is absent. The suspect claims the drive was formatted before the alleged deletion date and that a specific invoice file, “INV-2041.pdf,” was created on 9 June at 10:04, after the drive was seized on 5 June. The prosecution wants to rely on the file’s $STANDARD_INFORMATION creation timestamp. The defense asks whether the file can be recovered and whether the timestamp is reliable.
1. Assess the likelihood of recovering INV-2041.pdf and describe the steps you would take.
Read the worked answer
Recovery is possible but not guaranteed. A quick format does not zero all clusters; it creates new file-system structures and leaves much of the old data in unallocated space. However, 2.1 GB of new files can overwrite old clusters, and the new $MFT may reuse old records. The low count of deleted entries - 1,200 out of 284,000 - suggests that many old records are no longer in the active MFT.
The examiner should search for the filename in $MFT records, MFT slack, $LogFile, and unallocated space. If the file was resident in an MFT record, its data may still exist in an old record or slack. If it was nonresident, the examiner should identify candidate clusters and check whether they remain unallocated and uncorrupted. PDF carving by signature can recover content but may not preserve the filename or timestamps. The examiner should report a confidence level and distinguish a fully recovered file from a carved fragment. The absence of $UsnJrnl reduces corroboration but does not eliminate recovery options.
2. Evaluate the prosecution’s reliance on the $STANDARD_INFORMATION creation timestamp.
Read the worked answer
The $STANDARD_INFORMATION creation timestamp is not reliable on its own. It is user-mode accessible and can be modified by file-copy utilities, archiving tools, and anti-forensic utilities. Its value can also reflect a copy operation that preserved or reset timestamps. The examiner should compare it with the $FILE_NAME timestamps, which are stored differently and are generally less easily altered, though they are not immune. The $LogFile may record metadata changes, and the MFT record number and allocation state provide context.
A creation time of 9 June at 10:04, after the 5 June seizure, is impossible if the drive was in evidence continuously and the clock was accurate. But the timestamp alone does not prove post-seizure creation. Possible explanations include time-zone misinterpretation, a copy that preserved an earlier timestamp, clock error, or deliberate timestamp modification. The examiner should state what the artifact can and cannot prove, and should not testify that the timestamp establishes the file was created on that date without corroboration.
3. What alternative artifacts would you examine to establish when the file was created or copied?
Read the worked answer
The examiner should examine the $MFT record for both $STANDARD_INFORMATION and $FILE_NAME timestamps, the record’s allocation status, and the parent directory entry. The $LogFile should be parsed for transactions involving the file or its directory. Even without $UsnJrnl, the $Bitmap can show whether clusters are allocated, and $Secure may contain security descriptors tied to the record. Carved PDF metadata may include creation or modification times, producer information, and embedded paths.
Outside the file system, the examiner should look at Windows USB connection artifacts, link files, jump lists, email attachments, backup logs, and file-server records that may show the invoice’s earlier existence. The examiner should also test the suspect’s account of the format by comparing the format time with other file-system metadata and the timing of the 2.1 GB copy. The strongest conclusion will come from multiple independent artifacts, not from a single timestamp.