Digital Forensics Artifacts of the Microsoft Photos Application in Windows 10

Izdanje: Sinteza 2022 - International Scientific Conference on Information Technology and Data Related Research

DOI: 10.15308/Sinteza-2022-427-434

Oblast: Student Session

Stranice: 427-434

Link: https://portal.sinteza.singidunum.ac.rs/paper/895

Apstrakt:
Modern operating systems come equipped with software designed to improve user experience and offer a user-friendly environment while maintaining seamless integration and constant operation times, even when tackling demanding tasks. Applications generate extensive operation logs to aid the diagnostics and maintenance processes. Modern software often relies on the mechanism for cashing and storing additional data that can later be used to access requested resources faster, improving performance. These behaviors often lead to the creation of software artifacts in the form of logs, temporary files, and databases. These artifacts become crucial sources of information in forensic investigations. This paper analyses a set of artifacts created by the Microsoft Photos application that is the default photo viewer and editor in the Windows 10 operating system. Conducted research indicates that a large amount of potentially useful information is created during normal software operation. These fragments can be located and analyzed in files located in system directories. Further exploration reveals a set of valid digital forensic assets. These consist of user action logs, facial recognition identification results, optical character recognition strings acquired from images, metadata, information on devices used to capture the photo, and other information sources.
Ključne reči: Digital forensics, Database forensics, Software artifact forensics, Microsoft Photos, Windows 10
Priložene datoteke:
  • 427-434 ( veličina: 433,33 KB, broj pregleda: 280 )

Preuzimanje citata:

BibTeX format
@article{article,
  author  = {L. Jovanović and S. Adamović}, 
  title   = {Digital Forensics Artifacts of the Microsoft Photos Application in Windows 10},
  journal = {Sinteza 2022 - International Scientific Conference on Information Technology and Data Related Research},
  year    = 2022,
  pages   = {427-434},
  doi     = {10.15308/Sinteza-2022-427-434}
}
RefWorks Tagged format
RT Conference Proceedings
A1 Luka Jovanović
A1 Saša Adamović
T1 Digital Forensics Artifacts of the Microsoft Photos Application in Windows 10
AD Univerzitet Singidunum, Beograd, Beograd, Srbija
YR 2022
NO doi: 10.15308/Sinteza-2022-427-434
Unapred formatirani prikaz citata
L. Jovanović and S. Adamović, Digital Forensics Artifacts of the Microsoft Photos Application in Windows 10, Univerzitet Singidunum, Beograd, 2022, doi:10.15308/Sinteza-2022-427-434