DiskForge: Timestomping on Disk Images for Educational Benefit

View Full Paper

Ask AI

Bookmark

Authors

Discussion

DiskForge facilitates timestamp manipulation in disk images, highlighting challenges in forensic tools.

Timestamp manipulation using DiskForge enhances precision in disk images for educational purposes, making learning more effective.
The framework allows easy editing of structures like file system metadata and log files without technical barriers.
Demonstrating with SQLite databases, DiskForge reveals the fragility of current forensic tools in timestamp interpretation.
Creating perfect forgeries remains complex, as simply changing bits on disk does not guarantee accurate data representation.

Pohl et al. (2025) studied this question.

View Full Paper

Ask AI

Bookmark