Full Text Available
Note: Clicking the button above will open the full text document at the original institutional repository in a new window.
Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files
Dissertation (MSc (Computer Science))--University of Pretoria, 2026.
Saved in:
| Other Authors: | |
|---|---|
| Format: | Thesis |
| Language: | English |
| Published: |
University of Pretoria
2026
|
| Subjects: | |
| Tags: |
No Tags, Be the first to tag this record!
|
| _version_ | 1869483824121905152 |
|---|---|
| access_status_str | Open Access |
| author2 | Venter, Hein S. |
| author_browse | Venter, Hein S. |
| author_facet | Venter, Hein S. |
| collection | Thesis |
| dc_rights_str_mv | © 2024 University of Pretoria. All rights reserved. The copyright in this work vests in the University of Pretoria. No part of this work may be reproduced or transmitted in any form or by any means, without the prior written permission of the University of Pretoria. |
| description | Dissertation (MSc (Computer Science))--University of Pretoria, 2026. |
| format | Thesis |
| id | oai:repository.up.ac.za:2263/107794 |
| institution | University of Pretoria (South Africa) |
| language | English |
| last_indexed | 2026-07-01T04:05:08.001Z |
| license_str | Other — see source repository |
| provenance_str_mv | Harvested via OAI-PMH from UPSpace — University of Pretoria Institutional Repository |
| publishDate | 2026 |
| publishDateRange | 2026 |
| publishDateSort | 2026 |
| publisher | University of Pretoria |
| publisherStr | University of Pretoria |
| record_format | dspace |
| source_str | UPSpace — University of Pretoria Institutional Repository |
| spelling | oai:repository.up.ac.za:2263/107794 Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files Venter, Hein S. u19005068@tuks.co.za Mac Mahon-Maré, Chloé UCTD Sustainable Development Goals (SDGs) Alternate Data Streams (ADS) Mark-of-the-Web (MOTW) New Technology File System (NTFS) Master File Table (MFT) Digital Forensics Cybersecurity Dissertation (MSc (Computer Science))--University of Pretoria, 2026. Alternate Data Streams (ADS) are files on Windows devices in which the files are covertly stored within the metadata fields of other files, rendering them difficult for end-users and default Windows Application Programming Interfaces (APIs) to detect or access. Among these, Mark-of-the-Web (MOTW) files represent a specialised form of ADS, automatically attached by Windows systems to record the origin of files downloaded from a network. The covert nature of ADS and MOTW files introduces a substantial cybersecurity risk, as threat actors may exploit them to conceal malicious payloads, bypass security controls, or persist within compromised systems. Despite this, the routine exclusion of the monitoring of ADS and MOTW files from digital forensic investigations creates a critical gap in the acquisition, analysis and interpretation of potential digital evidence. This research addresses these challenges by proposing a novel process model that integrates the detection, extraction, and analysis of ADS and MOTW files into standard digital forensic workflows. The model is complemented by corresponding cybersecurity tools, enabling the automated identification and mitigation of threats hidden within these files. By bridging this gap, the proposed approach not only enhances the comprehensiveness of forensic investigations but also strengthens defensive cybersecurity capabilities, providing investigators and security practitioners with structured methodologies for managing hidden files. Prototype implementations demonstrate the practicality, efficiency, and forensic soundness of the approach, confirming its potential for adoption in both research and operational environments. Computer Science MSc (Computer Science) Unrestricted Faculty of Engineering, Built Environment and Information Technology None 2026-02-03T07:07:52Z 2026-02-03T07:07:52Z 2026-04-01 2026-02-02 Dissertation * A2026 http://hdl.handle.net/2263/107794 N/A en © 2024 University of Pretoria. All rights reserved. The copyright in this work vests in the University of Pretoria. No part of this work may be reproduced or transmitted in any form or by any means, without the prior written permission of the University of Pretoria. application/pdf University of Pretoria |
| spellingShingle | UCTD Sustainable Development Goals (SDGs) Alternate Data Streams (ADS) Mark-of-the-Web (MOTW) New Technology File System (NTFS) Master File Table (MFT) Digital Forensics Cybersecurity Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title | Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title_full | Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title_fullStr | Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title_full_unstemmed | Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title_short | Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files |
| title_sort | advancing digital forensics and cybersecurity a novel model for the detection and analysis of alternate data streams ads and mark of the web motw files |
| topic | UCTD Sustainable Development Goals (SDGs) Alternate Data Streams (ADS) Mark-of-the-Web (MOTW) New Technology File System (NTFS) Master File Table (MFT) Digital Forensics Cybersecurity |
| url | http://hdl.handle.net/2263/107794 |