Structure and application of IconCache.db files for digital forensics

Chan Youn Lee, Sangjin Lee

    Research output: Contribution to journalArticlepeer-review

    4 Citations (Scopus)

    Abstract

    Anti-forensics has developed to prevent digital forensic investigations, thus forensic investigations to prevent anti-forensic behaviors have been studied in various area. In the area of user activity analysis, "IconCache.db" files contain icon cache information related to applications, which can yield meaningful information for digital forensic investigations such as the traces of deleted files. A previous study investigated the general artifacts found in the IconCache.db file. In the present study, further features and structures of the IconCache.db file are described. We also propose methods for analyzing anti-forensic behaviors (e.g., time information related to the deletion of files). Finally, we introduce an analytical tool that was developed based on the file structure of IconCache.db. The tool parses out strings from the IconCache.db to assist an analyst. Therefore, an analyst can more easily analyze the IconCache.db file using the tool.

    Original languageEnglish
    Pages (from-to)102-110
    Number of pages9
    JournalDigital Investigation
    Volume11
    Issue number2
    DOIs
    Publication statusPublished - 2014 Jun

    Bibliographical note

    Funding Information:
    This research was supported by the Public Welfare & Safety Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Science, ICT & Future Planning (2012M3A2A1051106) and the Korea University Grant.

    Keywords

    • Anti-forensics
    • Digital forensics
    • Icon
    • IconCache.db
    • User behavior

    ASJC Scopus subject areas

    • Pathology and Forensic Medicine
    • Information Systems
    • Computer Science Applications
    • Medical Laboratory Technology
    • Law

    Fingerprint

    Dive into the research topics of 'Structure and application of IconCache.db files for digital forensics'. Together they form a unique fingerprint.

    Cite this