Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps
Round 1
Reviewer 1 Report
Work related to an important topic, which is the forensic exchange analysis of contact artifacts in digital world. From an editorial point of view, the manuscript is quite well developed, small notes are included below.
The scientific values of the theoretical work are not great, but from a practical point of view it is very interesting. The introduction to the work describes the ADS mechanism found in the NTFS file system. It is advisable to give an example of creating ADS for e.g. a simple text file using the command line. This will help the reader to have a practical understanding of this easy-to-use mechanism. Sample scenarios of experiments are given in the appendix, but a simple example with the addition of ADS to the file, reading the checksum before and after adding ADS, and presentation of the content of the file as well as its size before and after this operation can significantly facilitate further reading of the work of a reader who does not know this NTFS properties.
Techniques for evaluating the performance of ADS operations and developed experimental procedures for detecting them are interesting. The disadvantage of the work is the lack of analysis results referring to file sets that were not created by the author of the work. You can choose an experiment in which the user modifies files according to established scenarios, and researcher try (using his methods) to assess what changes / modifications / operations have occurred. I recommend adding such a test to work.
Specific editing remarks:
- figures 1 it is carelessly developed, it looks made in a hurry,
- figures 2 - 3 are hardly legible - the font is too small and deformed as a result of scaling.
Author Response
In response to Reviewer #1
The researcher would like to thank the editor and the three anonymous reviewers for their insightful comments and suggestions, which have helped to improve the quality of the paper. The researcher does the utmost to revise this paper for the publication requirements of Applied Sciences. The revised texts are highlighted by "underline" in the manuscript. The response lists below are made to summarize the revisions. Again, many thanks for the very positive information and feedback. The researcher trusts it is now suitable for publication in this Journal.
Best Regards,
Da-Yu Kao
June 15, 2020
Author Response File: 
Author Response.pdf
Reviewer 2 Report
The paper presents the forensic exchange analysis of contact artifacts on data hiding timestamps. According to the Author, the presented work aimed to provide a set of techniques for evaluating the performance of ADS operations. The provided example demonstrated experimental procedure for detecting ADS operations which played a significant role in crime reconstruction. The topic is interesting and the paper is well corresponding to the journal aim and scope.
However, there are shortcomings in this paper. The structure of this paper should be rebuilt. The Author uses a lot of subsections, which is particularly evident in the Introduction. Of course, this is one of the possibilities of presenting the results, but it can better maintain the continuity of the narrative and work on the layout of the article. According to the Reviewer, at least the Introduction should be rewritten. Please consider to move (at least partially) the limitations presented in section 1.2.2. at the end of this paper.
The article brings rather experimental research as the Author's contribution - the question is it a sufficiently strong contribution? What are the results of these experiments compared to other techniques for evaluating the performance of ADS operations? The Author should rebuild and extend this part. I suggest conducting comparative analyses of solution's efficiently using other up to date techniques. At the same time please provide extended contributions, findings and conclusions.
Minor typos:
- Line 83: there should be a colon at the end of the sentence.
- The list of reference should be extended.
Author Response
In response to Reviewer #2
The researcher would like to thank the editor and the three anonymous reviewers for their insightful comments and suggestions, which have helped to improve the quality of the paper. The researcher does the utmost to revise this paper for the publication requirements of Applied Sciences. The revised texts are highlighted by "underline" in the manuscript. The response lists below are made to summarize the revisions. Again, many thanks for the very positive information and feedback. The researcher trusts it is now suitable for publication in this Journal.
Best Regards,
Da-Yu Kao
June 15, 2020
Author Response File: Author Response.pdf
Reviewer 3 Report
The author propose to use the timestamp rules as an investigative approach to confirm the malicious use of ADS file.
The paper is not structured as a standard scientific paper.
The introduction should be rephrased to give the paper a solid overview of the background and specific aim.
The proposed Design of Observational Experiments lack of a clear workflow that should work in a general case. Furthermore, within the text, it is not clear the line between the general methodology and the specific test.
I suggest the author to resubmit the paper after taking into considerations the reviewers comments.
Author Response
In response to Reviewer #3
The researcher would like to thank the editor and the three anonymous reviewers for their insightful comments and suggestions, which have helped to improve the quality of the paper. The researcher does the utmost to revise this paper for the publication requirements of Applied Sciences. The revised texts are highlighted by "underline" in the manuscript. The response lists below are made to summarize the revisions. Again, many thanks for the very positive information and feedback. The researcher trusts it is now suitable for publication in this Journal.
Best Regards,
Da-Yu Kao
June 15, 2020
Author Response File: Author Response.pdf
Round 2
Reviewer 2 Report
As it was mentioned in the 1st revision, the paper presents the forensic exchange analysis of contact artifacts on data hiding timestamps. According to the Author, the presented work aimed to provide a set of techniques for evaluating the performance of ADS operations. The provided example demonstrated experimental procedure for detecting ADS operations which played a significant role in crime reconstruction. The topic is interesting and the paper is well corresponding to the journal aim and scope.
In the previous revision, my suggestions encompassed rebuilding the structure of the paper, moving limitations at the end of the paper, and also complete the study with additional comparative analyses of solution's efficiently using other up to date techniques. The Author was asked to provide extended contributions, findings and conclusions. In my opinion, the Author has put some effort to improve the article. Of course, there are still shortcomings, but the main part of the work has been done.
So - generally I found part my suggestions adressed.
MAJOR SHORTCOMING - The Author STILL uses a lot of subsections, - continuation of narration remains unclear...
Author Response
The researcher would like to thank the editor and the anonymous reviewers for their insightful comments and suggestions, which have helped to improve the quality of the paper. The researcher does the utmost to revise this paper for the publication requirements of Applied Sciences. The revised texts are highlighted by the "red" color in the manuscript. The response lists below are made to summarize the revisions. Again, many thanks for the very positive information and feedback. The researcher trusts it is now suitable for publication in this Journal.
Best Regards,
Da-Yu Kao
June 30, 2020
Author Response File: 
Author Response.doc
Reviewer 3 Report
The author improved the readability of the revised paper according the reviewers comments.
Author Response
The researcher would like to thank the editor and the anonymous reviewers for their insightful comments and suggestions, which have helped to improve the quality of the paper. The researcher does the utmost to revise this paper for the publication requirements of Applied Sciences. The revised texts are highlighted by the “red” color in the manuscript. The response lists below are made to summarize the revisions. Again, many thanks for the very positive information and feedback. The researcher trusts it is now suitable for publication in this Journal.
Best Regards,
Da-Yu Kao
June 30, 2020
Author Response File: Author Response.pdf
