Forensic analysis of persistent data storages analyzing NTFS formatted drives

Abstract

Computational forensic is a far-reaching field for criminal and civil laws in this age. Aim of this project is to develop an educational tool to analyze persistent storage devices to find possible evidences. Evidences are found as metadata information on these drives. These metadata information are collected in a comma separated value-CSV format document. This CSV file can be imported to a database and can be easily analyzed. By the classical forensic investigator tools mostly can analyze only one media at a time, but by this way more than one digital evidence can be comparatively analyzed. Also, deleted files may hold evidences, so recovering of deleted files is an additional topic for this study. The structured codes and related documents have shared on github as an open project; to give a chance to extension of this study by new projects and we hope that the product of this study can be useful tool for computational forensic courses.