Reverse engineering of ReFS

File system forensics is an important part of Digital Forensics. Investigators of storage media have traditionally focused on the most commonly used file systems such as NTFS, FAT, ExFAT, Ext2-4, HFS+, APFS, etc. NTFS is the current file system used by Windows for the system volume, but this may change in the future. In this paper we will show the structure of the Resilient File System (ReFS), which has been available since Windows Server 2012 and Windows 8. The main purpose of ReFS is to be used on storage spaces in server systems, but it can also be used in Windows 8 or newer. Although ReFS is not the current standard file system in Windows, while users have the option to create ReFS file systems, digital forensic investigators need to investigate the file systems identified on a seized media. Further, we will focus on remnants of non-allocated metadata structures or attributes. This may allow metadata carving, which means searching for specific attributes that are not allocated. Attributes found can then be used for file recovery. ReFS uses superblocks and checkpoints in addition to a VBR, which is different from other Windows file systems. If the partition is reformatted with another file system, the backup superblocks can be used for partition recovery. Further, it is possible to search for checkpoints in order to recover both metadata and content.Another concept not seen for Windows file systems, is the sharing of blocks. When a file is copied, both the original and the new file will share the same content blocks. If the user changes the copy, new data runs will be created for the modified content, but unchanged blocks remain shared. This may impact file carving, because part of the blocks previously used by a deleted file might still be in use by another file. The large default cluster size, 64 KiB, in ReFS v1.2 is an advantage when carving for deleted files, since most deleted files are less than 64 KiB and therefore only use a single cluster. For ReFS v3.2 this advantage has decreased because the standard cluster size is 4 KiB.Preliminary support for ReFS v1.2 has been available in EnCase 7 and 8, but the implementation has not been documented or peer-reviewed. The same is true for Paragon Software, which recently added ReFS support to their forensic product. Our work documents how ReFS v1.2 and ReFS v3.2 are structured at an abstraction level that allows digital forensic investigation of this new file system. At the time of writing this paper, Paragon Software is the only digital forensic tool that supports ReFS v3.x.It is the most recent version of the ReFS file system that is most relevant for digital forensics, as Windows automatically updates the file system to the latest version on mount. This is why we have included information about ReFS v3.2. However, it is possible to change a registry value to avoid updating. The latest ReFS version observed is 3.4, but the information presented about 3.2 is still valid. In any criminal case, the investigator needs to investigate the file system version found.     

Forensic analysis of WeChat on Android smartphones

WeChat is one of the most popular instant-messaging smartphone applications in the world. At the end of 2015, WeChat had 697 million monthly active users from over 200 countries. Although WeChat was designed originally for communication between relatives and friends, its abundant social functions are now also used by criminals for communication, and even for the organization and coordination of criminal acts. Therefore, communication records of social networking services like WeChat extracted from the smartphones of criminals are always the vital digital evidences for the investigation and prosecution of criminal cases. At present, only a few literatures focused on WeChat forensics. This paper describes several common questions that arise in forensic examinations of Android WeChat and provides corresponding technical methods that are useful to address these questions. This paper is intended to provide vital references for the investigators and researchers working on the digital forensics.     

构建东北亚IT共同体的设想及影响其制度化的因素

如果能够在东北亚地区建立IT产业的共同体,将很有可能带动其他产业的联合,最终走向全面地联合,从而提升东北亚地区合作的层次。东北亚国家已经开始在IT领域进行了一定程度的合作,但是在东北亚地区建立IT共同体的道路不会是一帆风顺的,有许多因素会影响到东北亚IT共同体的最终形成。     

Transdisciplinary innovation research in Uzbekistan – one year of ‘Follow-the-Innovation’

In 2008, a German-funded interdisciplinary research project in Khorezm province, Uzbekistan, initiated a participatory approach to innovation development and diffusion with local stakeholders. Selected agricultural innovations, developed by the project and identified as ‘plausible promises’, have since then been tested and modified accordingly by teams of researchers, local farmers and water users. This paper discusses the challenges faced in this process of joint experimentation and learning between researchers and local stakeholders whose behaviours, attitudes and actions are heavily shaped by the local context, academic discipline and hierarchical culture of knowledge governance.     

Attitude counts: engaging with rice farmers in West Africa

An international project called PADS promoted participatory learning and action research with inland valley rainfed rice farmers in West Africa. All countries received the same training, similar funding, and the same leadership. Although the staff in Ghana were conscientious and gave much training to the farmer beneficiaries, the Mali staff explicitly encouraged farmers to experiment. Farmers in Mali responded to this favourable attitude by experimenting more than those in Ghana, and in qualitatively more interesting ways. Long-term engagement with grassroots organisations may be as conducive to changing public servants' attitudes as the actual participatory approach promoted on the ground.

L'attitude compte: travail avec des riziculteurs en Afrique de l'Ouest

Un projet international appelé PADS a favorisé l'apprentissage participatif et la recherche-action avec des riziculteurs pratiquant la culture pluviale dans les vallées de l'intérieur des terres en Afrique de l'Ouest. Tous les pays ont reçu la même formation, un financement similaire et le même leadership. Alors que les membres du personnel du Ghana étaient consciencieux et dispensaient une formation considérable aux agriculteurs bénéficiaires, le personnel du Mali encourageait expressément les riziculteurs à faire des expériences. Les riziculteurs du mali ont réagi à cette attitude favorable en faisant plus d'expériences que ceux du Ghana, et ce de manières plus intéressantes sur le plan qualitatif. L'engagement à long terme avec les organisations de la base populaire peut être tout aussi propice à la modification des attitudes des fonctionnaires que l'approche participative même promue sur le terrain.

As atitudes contam: Engajamento com produtores de arroz na África Ocidental

Um projeto internacional chamado PADS promoveu uma pesquisa sobre aprendizado e ação participativa com produtores de arroz irrigado com água da chuva no interior do vale na África Ocidental. Todos os países receberam o mesmo treinamento, financiamento semelhante e a mesma liderança. Embora os funcionários de Gana estivessem cientes e oferecessem bastante treinamento aos produtores beneficiários, os funcionários de Mali incentivaram explicitamente os produtores a experimentar. Os produtores de Mali responderam a esta atitude favorável experimentando mais do que aqueles de Gana e de maneiras mais interessantes em termos qualitativos. O engajamento de longo prazo com organizações de base pode contribuir para mudar as atitudes dos servidores públicos tanto quanto a abordagem participativa real promovida na base.

La actitud cuenta: el trato personal con campesinos arroceros de África Occidental

Un proyecto internacional llamado PADS promovió el aprendizaje participativo y la investigación-acción entre campesinos que cultivaban arroz de secano en los valles centrales de África Occidental. Todos los países participantes recibieron la misma capacitación, un financiamiento similar y las mismas orientaciones. Si bien el personal de Ghana era muy diligente y transmitió muchos conocimientos a los campesinos beneficiarios en capacitaciones, el personal de Malí se centró más explícitamente en animarlos para que experimentaran. Los campesinos de Malí respondieron a esta actitud estimuladora realizando más experimentos y de maneras cualitativamente más interesantes que los campesinos de Ghana. El compromiso de largo plazo con organizaciones de base puede ser tan importante para lograr un cambio en la actitud del servidor público como el método participativo que se promueve en la actualidad sobre el terreno.     

Digital technology uses for sustainable management of natural resources in multicultural contexts

This article questions the notion that the use of digital technologies guarantees better policy development for the sustainable management of natural resources, particularly in multicultural contexts. It is argued that input of digital technologies could positively or negatively affect the geopolitical projects and development strategies pursued by indigenous peoples.     

What determines poverty transition? An investigation of women livestock farmers in Bangladesh

This article evaluates poverty transition using self-assessment in a quasi-experimental framework. Data are drawn from a survey conducted in 2006 of 400 women who were the beneficiaries of a poverty-alleviation programme which involved longer-term interventions towards building the strength of government departments, participating organisations, and beneficiaries. During the survey, when the project was approaching its conclusion, about 50 per cent of these farmers were still in the programme. The article addresses a number of key questions related to pathways out of poverty through livestock-based activities, heterogeneity in livelihood choice and its impact on household welfare, and wider applications.     

Planning for the succession of digital assets

Estate planners’ current strategies for the disposition of digital assets are quickly becoming out-dated. This is largely the result of ambiguities concerning proprietary rights of digital assets after death. When advising clients on how to plan for the succession of digital assets, it is important for estate planners to understand the nature of digital assets today and to recognize how these assets may evolve. In failing to take into account the evolving nature of digital assets, estate planners are liable to craft short-sighted and thus ineffective succession plans. As the popularity of digital executor businesses increases, estate planners ought to caution clients on their shortcomings. Additionally, legislatures must create statutes which outline the rights of individuals vis-à-vis online service providers.     

加快数字图书馆建设提升社院信息化水平

在信息技术快速发展和互联网应用广泛普及的今天,社会主义学院图书馆建设面临着重大的机遇与挑战。本文以福建省社会主义学院为例,对如何加快传统图书馆向数字图书馆转型,实现建设具有统一战线特色的文献和情报信息中心这一目标进行探索与思考。     

(Non‐)Enforcement of Directors’ Duties in Corporate Groups: Goh Chan Peng v Beyonics Technology Ltd

Corporate groups, a ubiquitous feature of modern business, pose formidable challenges for common law courts relying on traditional corporate law doctrine. Arising out of a corporate group's recent bid to recover millions of dollars in lost profits from a former director and CEO who had diverted a core business, Goh Chan Peng v Beyonics Technology Ltd raised thorny issues of separate legal entity doctrine, single economic unit theory, and reflective loss shared by common law legal systems. Despite finding that the defendant had breached his duties to the ultimate holding company, the Singapore Court of Appeal absolved the faithless director from most of his liabilities, relying on limited domestic precedent to the exclusion of a rich body of Commonwealth jurisprudence – including the House of Lords’ landmark Johnson v Gore Wood decision. This note explores the paths not taken by the court, and highlights the pitfalls of a narrow, autochthonous approach to problems of common law doctrine.