\chapter{Introduction}
\label{chpt:introduction}
\setlength{\parindent}{50pt}
%%%Follow this structure: https://www.scribbr.com/category/dissertation/
\begin{doublespace}
\begin{justify}
%\vspace{-10mm}
%\noindent 
%\noindent 
\noindent \hspace{50pt} In this dissertation, we investigated the new computer storage technology, Non-Volatile Memory Express (NVMe). Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.%\medskip

%\noindent 
\noindent \hspace{50pt} Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.

\vspace{-2mm}
\addcontentsline{toc}{section}{History and Motivation}
\section*{History and Motivation}

\noindent \hspace{50pt} Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. Figure \ref{fig:time-analysis0} talks about seminal advances in storage media technology over the years in conjunction with the development of different Microsoft Windows operating systems and corresponding forensics artifacts.

\begin{figure}[!htb]
	\centering
	%\captionsetup{justification=centering}
	\includegraphics[width=\linewidth]{chapters/figures_for_ch1_intro/timeline-gap-analysis0.png}
	\caption{The seminal advances in storage and OS technology/forensic artifact. \Cross- Topics covered under current research.}
	%\textbf{†}
	\label{fig:time-analysis0}
\end{figure}
%\medskip
%\medskip
%\medskip
%\noindent
\newpage 
\noindent \hspace{50pt} In this figure, we also highlight the pivotal changes Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%I-Corps\footnote{https://www.nsf.gov/news/special\_reports/i\-corps/} 

\vspace{-2mm}
\addcontentsline{toc}{section}{Prior Work}
\section*{Prior Work}

\noindent \hspace{50pt} Since its inception, numerous research initiatives have focused on solid-state drives (SSD) forensics. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. \medskip

\noindent \hspace{50pt} Hard disk drives, file recovery and carving have been challenging to effectuate. This is because the file system metadata information is required. Pal and Memon \cite{S1_evolution} Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.  

\noindent \hspace{50pt} Bell and Boddington \cite{S2_ssd_beginning} further substantiated the challenges posed by SSDs in the evidence collection process. Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum. 

\noindent \hspace{50pt} The author in \cite{S3_ssd_contruction} Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. Ritola did a similar work of file recovery on solid-state drives  \cite{S4_for_invest_ssd}. Ritola not only aimed to forensically retrieve information from the storage area of SSD but also the spare area or free space.

\noindent \hspace{50pt} Testing the forensic friendliness of an SSD has proven to be difficult, which can be seen from the research mentioned above. However, the article presented in  \cite{S5_black_box} Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. .

\noindent \hspace{50pt} In \cite{S6_infer_rw}, Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. . \cite{S7_for_ana_ssd} provided the basic techniques needed to conduct forensics investigations in HDDs and SSD. The authors have also explained the self-corrosion concept and the limited life span of an SSD hindering forensic investigations. Finally, the article discussed methods that can mitigate the impact of forensic analysis due to TRIM and the garbage collection features of the device.

\noindent \hspace{50pt} The author in \cite{S8_ssd_new_chal} extended the work done in \cite{S2_ssd_beginning}. The thesis presented by the author identified key evidence in HDDs and SSDs along with the self-destructive nature of SSD which causes difficulties in forensics investigations. Along the same line, the authors in \cite{S9_ssd_wl} cLorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. The authors in \cite{S10_side_channel} studied two firmware versions of an SSD controller using current draw signals. 

%\noindent \hspace{9mm} Freezing software are used to prevent unwanted changes to computer systems. Due to this the changes that occurred are not saved on the storage media. The article in \cite{S11_frozen_ssd} discussed the forensic importance of SSD media in recovering the data. The authors did confirm that the freezing software do put forensics analysis in jeopardy. Similarly, 

\noindent \hspace{50pt} Damaged or crushed storage media can pose a risk for file recovery. The research in \cite{S12_restore_ssd} discussed semantic carving and fragment recovery carving techniques for recovering files from a storage medium. In addition to this, the research highlighted in \cite{S13_current_trim} was very similar to \cite{S10_side_channel} in studying the TRIM operation of an SSD using a side-channel approach. The authors accurately inferred the TRIM operation with 99\% accuracy. Consequently, this directly has implications for malware detection, digital forensics, and consumer privacy.

\noindent \hspace{50pt} Presenting the digital evidence in a court of law is an accountable and strenuous task. Any tampering with the evidence will lead to the expulsion of the evidence. The research in \cite{S14_trim_wl_gc}, \cite{S15_trimming_ssd}, and \cite{S16_comparitive} demonstrated and offered guidelines for conducting forensics analysis in SSDs supporting TRIM, wear-leveling, and garbage collection features. The authors of the three research conducted experiments with different brands of SSDs for conducting forensics analysis and showed the impact of file recovery due to the different features of SSDs.

\noindent \hspace{50pt} Understanding state-of-the-art technology is necessary in every field. For this purpose, a survey is needed to know the current standing of the body of work or contribution. Kumar, Neyaz, and Shashidhar \cite{S17_ssd_survey_2020} put together a survey article highlighting the work done in SSD forensics. They discussed various research that talk about data recovery in SSDs. Additionally, the authors present the latest forensics techniques and ideas in the literature in the field of SSD forensics. 

\noindent \hspace{50pt} Our research is dedicated to conducting research on NVMe SSDs and for that purpose, we conducted an exhaustive survey of the literature on NVMe SSDs. The gaps in the forensics framework in SSDs have enhanced after the invention of NVMe SSDs. These storage devices have different command sets, and thus, ATA/SCSI commands do not work on them. Nikkel \cite{N1_nikkel} explored the NVMe technology and discussed its relevance to the digital forensics community. The author also mentioned the possible challenges when NVMe SSDs are involved, including the media's forensics acquisition. 

\noindent \hspace{50pt} With any type of SSD, SATA SSD, or NVMe SSD,  there is the concept of TRIM and wear-leveling attached to them. Due to these concepts, the forensics recoverability of data always becomes uncertain. The research in \cite{N2_analysis_nvme_static} talked about the ability of data recovery tools to restore digital evidence on a TRIM enabled NVMe SSD. The authors concluded that the TRIM feature affects data recovery. A similar study in \cite{N3_analysis_trim_nvme} talked about TRIM in NVMe SSDs in disabled and enabled cases. The authors affirmed that toggling TRIM on and off impacts the data recovery and forensics investigation.

\noindent \hspace{50pt} Windows artifacts such as Prefetch files, BootPerDiagLogger.etl, Shellbag, RunKey, ShellLink, Windows Search History, etc., yield a lot of information having high forensic importance. The work done by Garcia in \cite{Pf1_bulk_prefetch} talks about a scan\_winprefetch tool. The tool scans for Windows Prefetch files in forensic disk images, analyzes them, and creates an XML report. In \cite{ Pf2_prefetch_trojan} the author shows the working of the prefetching process and highlights the changes in prefetching technology in various Windows operating systems. The author also showed the evidentiary value related to Prefetch files. 
The mechanism behind the creation and manipulation ofcreating and manipulating the Prefetch files is worth investigating. The research in \cite{Pf3_df_prefetch} examined Prefetch files using the assembly code generated using IDA Pro software. The authors analyzed the Windows executable ntkrnlpa.exe to explore the kernel process responsible for creating prefetch files. 

\noindent \hspace{50pt} Process-related information is also a part of Windows artifacts. For example, the research conducted in \cite{Pf4_srum} describes the System Resource Usage Monitor (SRUM) mechanism responsible for tracking process and network statistics in Windows 8 and above. The authors also compared the information presented by SRUM analysis, using their custom-made tool, to correlate information found in SRUM. The authors took a very similar approach in \cite{Pf6_leverage}, where they examined the forensic information presented by Amcache.hve files with Prefetch, SRUDB.dat, and IconCache.db files to present useful forensics. 

\noindent \hspace{50pt} Hidden process is a serious threat when conducting a forensic investigation of a system. The author in \cite{Pf7_hpd} created a Hidden Processes Detector (HPD) program for detecting and revealing the hidden processes based on Windows Prefetch files. 

\noindent \hspace{50pt} Similarly, deleted user accounts also present a blockage in conducting forensics analysis. A user account contains a wealth of information related to a user, which is difficult to find when a user account is deleted. The authors in \cite{Pf8_for_del_artifact} researched this anti-forensic technique of deleting user accounts. 

\noindent \hspace{50pt} The research work conducted in \cite{Pf9_win10_change}, \cite{Pf10_pgm_exe}, \cite{Pf11_mani_pf}, and \cite{Pf12_mal_pf} talked about the prefetching technology in Windows 10 operating system. In addition, they explored the changes that happened due to the operating system update from Windows 8.1. Moreover, the research also talked about the effect of malware on Windows 10 prefetch files and what happens when a prefetch file is manipulated and re-compressed to hide entries from the file system. 

\noindent \hspace{50pt} Other avenues explored by our framework: the Shellbag and BootPerfDiagLogger.etl file in Windows 10 operating system. The BootPerfDiagLogger.etl file contains information about a computer system's booting information, whereas the Shellbag entries contain user preference information for browsing folders. The research done in \cite{B1_boot_browser} briefly talked about the log entry of Western Digital hard disk drive files found in BootPerfDiagLogger.etl file. In \cite{Sh1_reconst}, the authors introduced a novel method to analyze the Shellbag information from Windows XP Registry to reconstruct user activities by comparing successive registry snapshots. 

\noindent \hspace{50pt} A lot changed when Windows 7 was launched in 2009. Due to this change, the whole user-experience was redesigned and updated. This refinement led to changes in Shellbag as well. The authors of the research \cite{Sh2_shell_win7} investigated the Shellbag files in Windows 7 and created a timeline of user information by parsing the information from the files. Similarly, in \cite{Sh3_shell_reg}, the author investigated Shellbag files in Windows 8, 8.1, and the introductory version of Windows 10 of 2015. 

\noindent \hspace{50pt} Anti-forensics is another challenge in the area of digital forensics. The purpose of anti-forensics is to obfuscate the digital forensics investigation. When this nefarious technique is used to modify the areas of forensics importance in the Windows operating system, the amount of evidence found in an investigation can diminish. The thesis in \cite{Sh4_anti_for} talked about the anti-forensics wiping tools. The author tested the wiping tools on Shellbags, Prefetch, Jump Lists, etc., to check the impact of the wiping tools on these Windows artifacts. Muir, Leimich, and Buchanan \cite{Sh7_tor_brow} investigated the Tor browser and found user preference settings with the volatility tool plugin for Shellbag entries, \textbf{\textit{shellbags}}.

\noindent \hspace{50pt} There were more changes introduced when Windows 10 had subsequent updates since 2015. The authors in \cite{Sh6_win10_art} and \cite{Sh8_shell_time} investigated the changes in Windows artifacts such as Shellbags, Prefetch, Shimcache, and associated timestamps. They thoroughly analyzed the changes so that the forensics examiners do not misinterpret any valuable data.

\vspace{-2mm}
\addcontentsline{toc}{section}{Challenges of SSDs in Digital Forensics Investigations}
\section*{Challenges of SSDs in Digital Forensics Investigations}
%\noindent \hspace{50pt} The following are the challenges related to solid-state drives:

\begin{enumerate}
	\item Uncertainty in finding the evidence due to wear-leveling.
	
	\item Data fragmentation and changes in hash values due to the influence of wear-leveling mechanism.
	
	\item Purging of data immediately after deletion.
	
	\item The effect of TRIM on data from the operating system level.
	
	\item Influence of physical write-blocker and auto-mounting of the device in the operating system impacting the forensic analysis.
	
	\item Different forensic results due to the use of disparate NAND flash chips such as \textbf{Single-Level Cell (SLC)}, \textbf{Multi-level Cell (MLC)}, and \textbf{Triple-Level Cell (TLC)} on storage media.
	
	\item Every manufacturer implements the storage mechanism differently, impacting the forensic analysis due to proprietary standards.
	
	\item No procedure for forensic analysis in \textbf{Redundant Array of Independent Disks (RAID)} configuration of solid-state media.
	
	\item Unpredictable data storage pattern.
	
	\item The presence of hardware-level encryption and soldered storage that renders the forensic examination ineffective and unproductive. \\ 
\end{enumerate}

\vspace{-15mm}
\addcontentsline{toc}{section}{Challenges of Windows 10 artifacts (Prefetch, Shellbag, and BootPerfDiagLogger.etl) in Digital Forensics investigations}
\section*{Challenges of Windows 10 artifacts (Prefetch, Shellbag, and BootPerfDiagLogger.etl) in Digital Forensics Investigations}

\begin{enumerate}
	\item Conducting a comprehensive forensic analysis due to changes in Windows 10 prefetching technology due to operating system updates.
	
	\item Analyzing information about users' preferences and behavior using Shellbag entries.
	
	\item Decoding and analyzing the BootPerfDiagLogger.etl files of the boot process and obtaining useful information for forensics analysis.
\end{enumerate}

\end{justify}
\end{doublespace}