Abstract
NTFS is the most widely used disk partition format today, especially in personal computers and mobile storage devices, for its high security, excellent performance, and good convenience. After a file is normally deleted in NTFS file system, it can be still recovered by analyzing the file records and properties in MFT, and the deletion leave traces in the operation system which can be detected by the forensic tools. If the computer/USB device is lost or stolen, files on the hard disk, including the files that has been deleted, can be leaked which leaves a huge security risk. To securely and completely delete a file, this paper proposes a method of traceless file deletion for Windows NTFS file system. Experimental results show that the deleted file cannot be recovered and the deletion operation leaves no trace even by the forensic tools.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Govindarajan, M.: Challenges for big data security and privacy. Encyclopedia of Information Science and Technology. 4th edn, pp. 373–380. IGI Global, New York, NY (2018)
Gahi, Y., Guennoun, M., Mouftah, H.T.: Big data analytics: security and privacy challenges. In: IEEE Symposium on Computers and Communication, pp. 952–957. IEEE, Messina, Italy (2016)
Chen, L., Liu, F., Yao, D.: Enterprise data breach: causes, challenges, prevention, and future directions: enterprise data breach. Wiley Interdiscip. Rev. Data Mining Knowl. Discov. 7(C), e1211 (2017)
Microsoft Corporation: The NTFS File System (2008)
Microsoft Corporation: Choosing Between File Systems (2014)
Wang, L.Y., Ju, J.W.: Analysis of NTFS file system structure. Comput. Eng. Des. 27(3), 418–420 (2006)
Oommen, R.R., Sugathan, P.: Recovering deleted Files from NTFS. Int. J. Sci. Res. 51(6), 205–208 (2016)
Yoo, B., Park, J., Bang J., Lee S.: A study on a carving method for deleted NTFS compressed files, In: 3rd International Conference on Human-Centric Computing, pp. 1–6. IEE, Cebu, Philippines (2010)
Peng, Z., Feng, X., Tang, L., Zhai, M.: A data recovery method for NTFS files system. In: Niu, W., Li, G., Liu, J., Tan, J., Guo, L., Han, Z., Batten, L. (eds.) ATIS 2015. CCIS, vol. 557, pp. 379–386. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48683-2_34
Feng, F.J., Li, X.J., Yao, J.P.: Design and implementation of data recovery system based on NTFS. DEStech Trans. Comput. Sci. Eng. 291, 240–244 (2018)
Zhang, N., Jiang, Y., Wang, J.: The research of data recovery on Windows file systems. In: International Conference on Intelligent Transportation, Big Data & Smart City, pp. 644–647, IEEE, Vientiane, Laos (2020)
Frields, J.: National Industrial Security Program. Operating manual supplement technical report, Department of defense Washington DC (1995)
Dong, B.O., Park, K.H., Kim, H.K.: De-wipimization: detection of data wiping traces for investigating NTFS file system. Comput. Secur. 99, 102034 (2020)
Park, K.J., Park, J.M., Kim, E.J., Cheon, C.G., James, J.I.: Anti-forensic trace detection in digital forensic triage investigations. J. Dig. Foren. Secur. Law 12(1), 8–15 (2017)
Horsman, G.: Digital tool marks (DTMs): a forensic analysis of file wiping software. Aust. J. Forensic Sci. 53(1), 1–16 (2019)
Karresand, M., Axelsson, S., Dyrkolbotn, G.O.: Disk cluster allocation behavior in Windows and NTFS. Mobile Networks Appl. 25(3), 248–258 (2020)
Acknowledgments
This work was supported by the National Key Research and Development Program of China (2018YFB0804104), National Natural Science Foundation of China (62102209), Shandong Provincial Key Research and Development Program (2021CXGC010107, 2020CXGC010107, 2019JZZY020715), the Shandong Provincial Natural Science Foundation of China (ZR2020KF035).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Xu, S., Wang, F., Wang, L., Chang, X., Yang, T., Yang, W. (2022). A Method of Traceless File Deletion for NTFS File System. In: Chen, X., Shen, J., Susilo, W. (eds) Cyberspace Safety and Security. CSS 2022. Lecture Notes in Computer Science, vol 13547. Springer, Cham. https://doi.org/10.1007/978-3-031-18067-5_8
Download citation
DOI: https://doi.org/10.1007/978-3-031-18067-5_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-18066-8
Online ISBN: 978-3-031-18067-5
eBook Packages: Computer ScienceComputer Science (R0)