Fergus Tomas Toolan

• Bergum, Ulf; Toolan, Fergus; Stephens, Paul & Humphries, Georgina Louise (2025). Live data forensic tool testbed: Proof of concept. Forensic Science International: Digital Investigation. ISSN 2666-2825. 54, p. 301973–301973. doi: 10.1016/j.fsidi.2025.301973. Full text in Research Archive Show summary

  Live Data Forensics (LDF) has become a vital means of gathering digital evidence in criminal investigation. Due to advances in technology it is no longer sufficient to merely pull-the-plug instead many systems are analysed while running. However, this means that the evidence that will be relied upon in court is being changed as the LDF techniques are employed. This breaks the fundamental principle of forensics i.e. do not change the evidence. There are certain circumstances in which it is allowed to alter evidence but in these cases the practitioner must be able to explain the implication of their actions. As we are unable to determine how much information changes during LDF it is not possible to fully report the implications. This paper focuses on the topic of memory forensics and its importance in digital investigations in the context of the evaluation of LDF tools and their footprints. This paper introduces a simulated proof of concept testbed environment which demonstrates the possibility of validating and evaluating the performance of LDF tools. This is achieved through the development of a simulated processor which logs all alterations to memory as they occur. In parallel this paper introduces a specialised instruction set which can be used to trace the execution of the forensic process through RAM. The combination of these allows for the validation of RAM acquisition tools and the determination of the footprint of all LDF tools. The combination of these will, if fully implemented in the future, allow for the comparison of LDF tools in terms of the least impactful on the underlying evidential data. This will in turn lead to better understanding of the consequences of LDF actions and in turn more reliable evidence being available in court.

• Toolan, Fergus & Humphries, Georgina Louise (2025). Data hiding in the XFS file system. Forensic Science International: Digital Investigation. ISSN 2666-2825. 52. doi: 10.1016/j.fsidi.2025.301884. Full text in Research Archive
• Toolan, Fergus & Humphries, Georgina Louise (2025). Data hiding in symbolic link slack space. Forensic Science International: Digital Investigation. ISSN 2666-2825. 53. doi: 10.1016/j.fsidi.2025.301919. Full text in Research Archive
• Stoykova, Radina; Nordvik, Rune; Ahmed, Munnazzar; Franke, Katrin; Axelsson, Stefan & Toolan, Fergus (2022). Legal and technical questions of file system reverse engineering. Computer Law and Security Review. ISSN 0267-3649. 46. doi: 10.1016/j.clsr.2022.105725. Full text in Research Archive Show summary

  Reverse engineering of file systems is indispensable for tool testing, accurate evidence acquisition, and correct interpretation of data structures by law enforcement in criminal investigations. This position paper examines emerging techno-legal challenges from the practice of reverse engineering for law enforcement purposes. We demonstrate that this new context creates uncertainties about the legality of tools and methods used for evidence acquisition and the compliance of law enforcement with obligations to protect intellectual property and confidential information. Further identified are gaps between legal provisions and practice related to disclosure and peer-review of sensitive digital forensic methodology, trade secrets in investigations, and governmental vulnerability disclosure. It is demonstrated that reverse engineering of file systems is insufficiently addressed by legislators, which results in a lack of file system interpretation and validation information for law enforcement and their dependence on tools. Outlined are recommendations for further developments of digital forensic regulation.

• Nordvik, Rune; Stoykova, Radina Raychova; Franke, Katrin; Axelsson, Stefan & Toolan, Fergus (2021). Reliability validation for file system interpretation. Forensic Science International: Digital Investigation. ISSN 2666-2825. 37, p. 1–14. doi: 10.1016/j.fsidi.2021.301174. Full text in Research Archive Show summary

  This paper examines current best practices for Digital Forensic (DF) tool and method validation in the context of file system interpretation for digital evidence. In order to meet the legal and scientific requirements in criminal procedures file system (FS) reverse engineering (RE) is a necessity. Currently, there is no standard procedure for reliability testing of FS RE. Ideal validation requirements exist, but they are on high-level and practical implementation is missing. In this paper we propose a formal reliability validation procedure for file system reverse engineering, documenting the forensic process, including the tools used, ensuring reliability and reproducibility of the method and the results. The procedure is based on legal and scientific criteria and tested against file system reverse engineering methods. It is applicable to all types of reverse engineering methods in digital forensics.

• Porter, Kyle; Nordvik, Rune; Toolan, Fergus & Axelsson, Stefan (2021). Timestamp prefix carving for filesystem metadata extraction. Forensic Science International: Digital Investigation. ISSN 2666-2825. 38, p. 1–13. doi: 10.1016/j.fsidi.2021.301266. Full text in Research Archive Show summary

  While file carving is a popular and effective method for extracting file content from unallocated space in a forensic image, it can be time consuming to carve for the wide variety of possible file signatures. Furthermore, file carving does not connect the discovered file to its filesystem metadata. These limitations of file carving are the advantages of Generic Metadata Time Carving, in which filesystem metadata is searched for by first finding repeated co-located timestamps using a potential timestamp carving algorithm. The potential metadata is verified by a filesystem specific parser, and the pointer within the metadata to the file data may allow for full file recovery. Currently, a limitation of the Generic Metadata Time Carving method is that it will only find metadata records that have multiple equivalent timestamps, thus missing metadata records and files with differing, but very similar, timestamps. Therefore, in order to improve the recall of the Generic Metadata Time Carving methodology, we have designed and implemented a prefix matching potential timestamp carving algorithm. We apply our experiments to realistic NTFS and Ext4 forensic images, in which we compare the precision and recall results for differing prefix lengths. Our results indicate that using prefix-based potential timestamp carving can yield significantly greater recall for extracting filesystem metadata records, with little to no reduction in precision as compared to the original exact potential timestamp carving method.

• Nordvik, Rune; Porter, Kyle; Toolan, Fergus; Axelsson, Stefan & Franke, Katrin (2020). Generic Metadata Time Carving. Forensic Science International: Digital Investigation. ISSN 2666-2825. 33. doi: 10.1016/j.fsidi.2020.301005. Full text in Research Archive Show summary

  Recovery of files can be a challenging task in file system investigations, and most carving techniques are based on file signatures or semantics within the file. However, these carving techniques often only recover the files, but not the metadata associated with the file. In this paper, we propose a novel, generic approach for carving metadata by searching for equal and co-located timestamps. The rationale is that there are some common metadata for files and directories within each file system. Our generic time carver provides potential timestamp locations for repeated timestamps in each metadata structure, identifying potential metadata for files. A semantic parser then filters the results with respect to the specific file system type. In our experiments, extraction of MFT entries in NTFS and inodes in Ext4 had near perfect precision for metadata entries with multiple equivalent timestamps, and for such metadata structures we obtained perfect recall for NTFS. For known file systems, we use the information found within identified metadata to recover files, and by recovering files and their associated metadata we increase the evidential value of recovered files.

• Nordvik, Rune; Georges, Henry; Toolan, Fergus & Axelsson, Stefan (2019). Reverse engineering of ReFS. Digital Investigation. The International Journal of Digital Forensics and Incident Response. ISSN 1742-2876. 30(September), p. 127–147. doi: 10.1016/j.diin.2019.07.004. Full text in Research Archive Show summary

  File system forensics is an important part of Digital Forensics. Investigators of storage media have traditionally focused on the most commonly used file systems such as NTFS, FAT, ExFAT, Ext2-4, HFS+, APFS, etc. NTFS is the current file system used by Windows for the system volume, but this may change in the future. In this paper we will show the structure of the Resilient File System (ReFS), which has been available since Windows Server 2012 and Windows 8. The main purpose of ReFS is to be used on storage spaces in server systems, but it can also be used in Windows 8 or newer. Although ReFS is not the current standard file system in Windows, while users have the option to create ReFS file systems, digital forensic investigators need to investigate the file systems identified on a seized media. Further, we will focus on remnants of non-allocated metadata structures or attributes. This may allow metadata carving, which means searching for specific attributes that are not allocated. Attributes found can then be used for file recovery. ReFS uses superblocks and checkpoints in addition to a VBR, which is different from other Windows file systems. If the partition is reformatted with another file system, the backup superblocks can be used for partition recovery. Further, it is possible to search for checkpoints in order to recover both metadata and content. Another concept not seen for Windows file systems, is the sharing of blocks. When a file is copied, both the original and the new file will share the same content blocks. If the user changes the copy, new data runs will be created for the modified content, but unchanged blocks remain shared. This may impact file carving, because part of the blocks previously used by a deleted file might still be in use by another file. The large default cluster size, 64 KiB, in ReFS v1.2 is an advantage when carving for deleted files, since most deleted files are less than 64 KiB and therefore only use a single cluster. For ReFS v3.2 this advantage has decreased because the standard cluster size is 4 KiB. Preliminary support for ReFS v1.2 has been available in EnCase 7 and 8, but the implementation has not been documented or peer-reviewed. The same is true for Paragon Software, which recently added ReFS support to their forensic product. Our work documents how ReFS v1.2 and ReFS v3.2 are structured at an abstraction level that allows digital forensic investigation of this new file system. At the time of writing this paper, Paragon Software is the only digital forensic tool that supports ReFS v3.x. It is the most recent version of the ReFS file system that is most relevant for digital forensics, as Windows automatically updates the file system to the latest version on mount. This is why we have included information about ReFS v3.2. However, it is possible to change a registry value to avoid updating. The latest ReFS version observed is 3.4, but the information presented about 3.2 is still valid. In any criminal case, the investigator needs to investigate the file system version found.

• Nordvik, Rune; Toolan, Fergus & Axelsson, Stefan (2019). Using the object ID index as an investigative approach for NTFS file systems. Digital Investigation. The International Journal of Digital Forensics and Incident Response. ISSN 1742-2876. 28, p. 30–39. doi: 10.1016/j.diin.2019.01.013. Full text in Research Archive Show summary

  When investigating an incident it is important to document user activity, and to document which storage device was connected to which computer. We present a new approach to documenting user activity in computer systems using the NTFS file system by using the $ObjId Index to document user activity, and to correlate this index with the corresponding records in the MFT table. This may be the only possible approach when investigating external NTFS storage devices, and is hence a valuable addition to the storage forensics toolbox.

• Hansen, Kurt-Helge & Toolan, Fergus (2017). Decoding the APFS file system. Digital Investigation. The International Journal of Digital Forensics and Incident Response. ISSN 1742-2876. 22, p. 107–132. doi: 10.1016/j.diin.2017.07.003. Full text in Research Archive

View all works in NVA

• Sunde, Nina; Gundhus, Helene Ingebrigtsen; Dahl, Johanne Yttri; Toolan, Fergus & Dror, Itiel E. (2022). Constructing digital evidence: A study on how cognitive and human factors affect digital evidence. Universitetet i Oslo. Full text in Research Archive Show summary

  We live in a globalized, digitized and interconnected society, where technology is woven into virtually every aspect of our social relationships and activities. Actions, movements, and communication leave digital traces, often without the actor's knowledge or effort. Such traces are also of great importance for solving crimes. It is therefore essential that digital traces are collected, examined, analysed, and presented in a way that safeguards their evidential value and minimizes erroneous and misleading results. Much research has been done on new methods, tools, processes, and frameworks for handling new technology or new ways of using technology. However, there are relatively few empirical studies of investigative practice among the police's experts in digital traces and evidence - the digital forensic (DF) practitioners. The thesis contributes to filling this knowledge gap with new insight into DF investigation practices, with the main emphasis on how the evidence is analysed and presented. A combination of research methods is used to answer the research question: How can a better understanding of the DF practitioners' role in constructing digital evidence within a criminal investigation enable mitigation of errors and safeguard a fair administration of justice? The thesis is made up of five articles exploring the research question from different perspectives. DF practitioners may be biased The thesis shows that DF practitioners can be influenced by information about the case without significance for the investigation, for example about what type of crime other investigators believe has happened or their assumptions about a suspect's role in the crime that is investigated. This is an important finding since such information easily flows to the DF investigator during the dissemination of assignments and collaboration during the investigation. The research shows that such information influenced how many traces the DF investigators uncovered, and that there is great variation in how they interpreted and concluded about the findings. Digital evidence is elastic Digital evidence is usually perceived as objective, value-neutral and reliable, and is therefore often assigned great value during the investigation and in the court of law. The thesis shows that DF practitioners affect the value of the digital traces through how they describe and present them in their reports. In some cases, this turns out as incorrect and misleading descriptions of the credibility of the traces or their relevance to the criminal case. This can, for example, be descriptions that point towards the suspect's guilt or innocence, or descriptions that present the evidence as more credible than what the investigation in fact provides as a basis for. The thesis’s findings are important for a better understanding of the uncertainties associated with digital traces and evidence, and for being able to develop effective quality assurance measures for DF investigations that can prevent errors of justice and safeguard the rule of law for those who are investigated by the police.

View all works in NVA