Enhancement of forensic capabilities of the linux kernel via file timestamp preservation
Issue title: Special Supplement Issue in Section A and B: Selected Papers from the ISCA International Conference on Software Engineering and Data Engineering, 2011
Affiliations: National Institute of Technology, Durgapur, India | Department of Computer Science, Winona State University, Winona, MN, USA
Correspondence:
[*]
Corresponding author: Suvrojit Das, National Institute of Technology, M.G. Avenue, Durgapur 713209, India. Tel.: +91 9734294105.
Abstract: The National Institute of Standards and Technology [1] lists the importance of preservation of file time stamps for forensic and intrusion detection purposes. Most operating systems keep track of certain timestamps related to files, the most commonly used timestamps being modification, access, er, UNIX based Operating systems retain the last modification, last inode change, and last access times. This relates to the fact that operating systems only have the most recently updated file timestamp information, which along with any inaccuracies does not guarantee a successful recreation of timeline of events, for an effective incident response. This paper proposes a novel approach in terms of augmenting the core of pathname lookup operation in the LINUX kernel, towards accurate and authentic preservation of file time stamps of system wide critical files.
Keywords: Modification, access and creation date and time stamp, Host Based Intrusion Detection System (HIDS), Virtual File System (VFS), kernel function, nameidata and dentry data structures
