GVFS metadata: Shellbags for Linux

There are a number of techniques that the perpetrator of an offence may use to hide data. These techniques include storing data on external devices or within encrypted containers. Although there are a number of recorded artefacts for the Windows operating system which may prove this, there is less information for artefacts for the Linux operating system. The Gnome Virtual File System produces files that relate to specific volumes and contain information about files stored within the volume, whether external device or encrypted volume. Examination of these files provides the potential to identify the names of files accessed, as well as the last accessed time of the files. This paper establishes some rules of when a filename is recorded in the metadata files and what data is recorded when the file is deleted, which can provide potentially useful information.