Search

When theft of a physical item occurs it is detectable by the fact that the object is missing, however, when the theft of a digital item occurs it can go unnoticed as exact replicas can be created. The original file is left intact but valuable information has been absconded. One of the challenges facing digital forensic examiners is detecting when files have been copied off of a computer system in some fashion. While certain methods do leave residual evidence behind, CD Burning has long been held as a copying method that cannot be identified. Through testing of the burning process and close examination of the New Technology File System (NTFS), artifacts from the master file table in the various versions of Microsoft Windows, markers have been found that are associated with copying or “burning” files to CD or DVD. Potential evidence that was once overlooked may now be detectable.

A portable file directory system that provides a machine-independent method for specifying files is described. The portable directory system, or PDS, facilitates uniform usage of portable software by supplying a standard for file specification. The PDS supports a hierarchical directory structure, similar to that in UNIX and Multics, and a set of primitives for manipulating the structure and preparing files for input/output. While the PDS participates in file specification, it does not participate in the actual i/o; it has no impact on i/o efficiency. The implementation, which is easily extended to include additional capabilities, is described. Experience in using the PDS as a part of command interpreters and preprocessors is also discussed.

This paper describes a processor which automatically produces file conversion programs based on non-procedural user specification. The processor accepts, as input, descriptions of a source file and a desired target file with some auxiliary descriptions of associations between the two. This is specified by a user in a Data Description Language (DDL). To specify validation criteria, complex conversions not built in to the system, security criteria or summary processes, the system also accepts specifications in a Data Manipulation Language (DML). It produces, as an output, a conversion program in PL/1 capable of converting the described source file into the desired target file. The paper describes the structure, system design, capabilities and applications of the DDL/DML language and processor, including an illustrative example.

The CAPRI file management system was designed to handle document references as well as more regular data such as that found in administrative or fact files. The ASIS file problem exercised several significant features of this system, including a powerful input processor, definition control, and its file maintenance and retrieval-output modules.

A determination is made of the optimum ratio of records to file guides to minimize searching time in an ordered two-level file such as a library card catalog. The solution is proportional to the square root of the number of records in the file container (card drawer). When scanning rates for cards and for file guides are equal, the solution is exactly the square root of file size. Simplifying assumptions employed in this determination are discussed. It is asserted that most library card catalogs contain far fewer file guides than would be justified in order to minimize searching time for users.