Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
10341581 | Digital Investigation | 2005 | 5 Pages |
Abstract
This paper defines the attributes that are required to provide 'good' provenance. The various sources that may be used to verify the provenance of digital information during the investigation of a Microsoft® Windows® based computer system are presented. This paper shows how provenance can be corroborated by artefacts which indicate how a computer system was connected to the outside world and the capabilities that it provided to a user. Finally consideration is given to a number of commonly used forensic tools and shows how they represent the provenance of information to an investigator.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
Philip Turner,