Data trace as the scientific foundation for trusted metrological data: a review for future metrology direction

Prior knowledge

The application layer is an advanced stage of data processing, primarily responsible for high-level data management and operations. At this stage, the data has typically undergone initial encoding, decoding, and transformation, making it meaningful and usable. Multimedia data, such as images, audio, and video, are common data types used at this stage. For example, in the field of metrology, digital calibration certificates (Neyezhmakov, Zub & Pivnenko, 2021) and industrial measurement inspection images (Lins, Santos & Gaspar, 2023) are part of multimedia data.

Existing multimedia data tampering operations typically include deleting, hiding, or replacing specific regions, adding new elements, and adjusting the size or position of existing elements. Although these tampering operations may leave no visible or audible traces through anti-forensic techniques, the data’s underlying structure, encoding methods, and compression characteristics often still reflect traces of modification. Through specific detection techniques, these traces can generally be identified and restored, revealing whether the data has been tampered with or forged (Farid, 2016).

Related research

Currently, the majority of research focuses on multimedia data tampering detection, covering areas such as text, images, audio, and video. Additionally, some studies are dedicated to the detection of anti-forensic attacks. The literature related to application-layer data traces is summarized in Table 3.

In summary, current application-level data trace detection methods can be classified into two main categories: active detection and passive detection, as shown in Fig. 7. Active detection methods rely on auxiliary information, such as digital watermarks, digital signatures, and revision save identifiers (RSID), to ensure the authenticity and integrity of the data. These methods embed additional markers or information into the data, enabling timely detection in the event of tampering. However, a limitation of active detection methods is that they require pre-embedded anti-tampering mechanisms, and in some cases, an attacker may be able to remove or modify these identifying markers. In recent years, blockchain technology has received increasing attention in the field of active detection. Its decentralized and immutable features effectively enhance data security (Sakshi, Malik & Sharma, 2024; Ramezanzadehmoghadam, 2024); however, since this study focuses on detecting traces of tampered data, blockchain technology is not the primary focus of this article.

In contrast, passive detection methods do not rely on any pre-embedded information, but rather analyze the inherent characteristics of the data itself. These methods detect tampering by exploiting inevitable inconsistencies during the tampering process, such as pixel-level anomalies, geometric distortions, physical lighting inconsistencies, and compression artifacts. Since passive detection methods do not require special processing during data generation, they offer greater flexibility and are less susceptible to tampering by attackers. However, the detection accuracy of these methods typically depends on the quality of the data. When facing issues such as blurred data edges, compression, or noise, the performance of the technology may degrade, leading to a higher false positive rate.

Researchers are actively exploring the use of emerging technologies, such as deep learning (Padilha et al., 2022; Leonzio et al., 2023; Shaikh & Kannaiah, 2025), to enhance detection capabilities. Although deep learning methods have made significant progress in certain applications, the existing methods typically use different evaluation metrics and datasets, making comparisons between them difficult. Additionally, while improving detection accuracy helps identify more tampered behavior, it often increases computation time and resource consumption, which presents a significant challenge in current research. Therefore, balancing detection accuracy, time efficiency, and resource consumption remains a critical issue that future application-level research must address.

Prior knowledge

Operating systems generate and manage various metadata during data transmission, typically including file operation records, user activities, and system states. However, different operating systems exhibit significant differences in data processing, recording methods, and log management strategies. The major operating systems, as shown in Fig. 8, can generally be divided into two branches: one based on Microsoft Windows and the other derived from Unix. The Windows NT series features a complex event logging system that comprehensively records file operations, user logins, and other activities. In contrast, Unix/Linux systems typically rely on syslog to log system behaviors, resulting in a narrower scope of logs compared to Windows systems. macOS combines a Unix-style logging system with its own activity monitoring tools, enabling the capture of a broad range of system and user activity information. Therefore, understanding the data processing methods and log recording mechanisms of different operating systems is crucial for effective digital trace detection.

Related research

In recent years, researchers have conducted extensive studies on trace detection at the operating system level, covering most mainstream operating systems. Table 4 summarizes the literature related to operating system data traces.

In summary, trace detection at the operating system level encompasses multiple mainstream operating systems, with a primary focus on tampering detection in system logs and file metadata, particularly addressing core issues such as data deletion, timestamp forgery, and malware forensics. For instance, the temporal metadata analysis method proposed by Todd & Peterson (2024) demonstrated exceptionally high recall and accurate recognition of user behavior scenarios, particularly with significant breakthroughs in reducing the need for training data, which is crucial for enhancing forensic efficiency and accuracy. Additionally, the timestamp validation framework introduced by Pieterse, Olivier & Van Heerden (2015, 2016, 2017, 2019) for Android and iOS platforms greatly improved the detection of data tampering in mobile devices, showing strong adaptability and accuracy when dealing with timestamp forgery in databases.

However, despite these advancements, there remains a notable bias in the research on operating system-level data trace detection. Most of the research focuses on Windows and Android systems, while studies on Unix-like systems and iOS (particularly due to the constraints of closed ecosystems) are relatively scarce. Although some scholars (Garland et al., 2024) have made positive strides in cross-platform forensics, the challenges posed by the forensic limitations of closed ecosystems and the fragmentation of open systems still result in insufficient generalization and cross-platform compatibility of current technologies. Therefore, future research should place greater emphasis on improving the general applicability of existing technologies, particularly in both open and closed ecosystem environments, to address compatibility issues across different operating systems.

Prior knowledge

The file system records various metadata associated with files, documenting the entire history of file operations, from creation and modification to deletion, and even enabling the traceability of a file’s origin and content changes. As such, it is a crucial source of data traces. Currently, there is a wide variety of file systems used across different fields, and for the same operating system, multiple file systems are typically available for selection, as detailed in Table 5. Different types of file systems generate varying amounts and types of metadata and utilize their own unique mechanisms to record and manage this metadata. In short, the complexity of the file system’s design directly affects the richness and accuracy of its metadata.

For example, the NTFS file system (Fig. 9), compared to the FAT file system (Fig. 10), records more detailed operational information and logs, thus generating richer metadata. The potential data traces produced by these file systems provide critical support for trace detection technologies, enabling researchers to more easily track the full lifecycle of data and effectively identify traces of file tampering and their origins (Buchholz & Spafford, 2004).

Related research

Table 6 summarizes the key research findings related to file system trace detection.

In the field of file system-level trace detection, timestamp analysis occupies a central position. Current research has gradually evolved from traditional temporal rule modeling to multi-dimensional detection techniques. However, experiments by Galhuber & Luh (2021) on seven types of third-party tampering tools indicate that existing detection methods still face the challenge of increasingly sophisticated falsification techniques. For example, attackers may exploit redundant fields in the lower layers of the file system to bypass traditional validation mechanisms, thereby evading detection.

Moreover, differences in file systems pose significant challenges to forensic reliability. Studies have shown that the characteristics of different file systems directly affect the effectiveness of detection. For example, the ambiguity in timestamp interpretation of exFAT across Windows, Linux, and macOS may lead to conflicting forensic conclusions across platforms (Nordvik & Axelsson, 2022).

Overall, current research faces three major bottlenecks: first, an overemphasis on NTFS, which results in the delayed development of detection methodologies for other file systems; second, detection algorithms are predominantly based on laboratory environments, lacking robustness validation in complex real-world scenarios; and third, there is a lack of evaluation of the trustworthiness of forensic tools themselves.

Prior knowledge

Storage devices can be classified into two main categories: persistent storage and volatile storage (see Fig. 11). Persistent storage includes hard drives (HDD), solid-state drives (SSD), and flash memory, all of which are characterized by their ability to retain data for long periods even after power loss, through physical or electronic media. For example, an HDD relies on magnetic platters to store data, and data can sometimes be recovered even after the device has been formatted. In contrast, an SSD uses different storage and deletion mechanisms, and its data storage and erasure processes are unique. In some cases, an SSD may even support permanent data deletion, a feature that makes it easier for criminals to tamper with or delete data traces (Kumar, 2021). Additionally, there is no straightforward method to effectively prevent the recovery of data traces after an SSD has been erased.

In contrast to persistent storage, volatile storage refers to storage devices that lose data after power is removed, such as common DDR4 and DDR5 memory. Since volatile memory can only retain data while power is supplied, special care must be taken when collecting and analyzing data from volatile storage to avoid interfering with the contents of the memory during its operation. Trace analysis of volatile storage typically relies on memory dump techniques, which quickly extract data from memory to recover information such as program states and user activity logs (Nyholm et al., 2022). However, the dynamic nature of memory data and the loss of data upon power down make volatile storage trace analysis more challenging compared to persistent storage.

Related research

In recent years, research on storage device traces has mainly focused on memory acquisition techniques, and therefore, the studies summarized in Table 7 are primarily concentrated in the field of memory forensics.

In recent years, volatile device data detection has taken a dominant position in the research on trace detection at the storage device layer. This is primarily due to the high investigative value of the data stored in the system’s random access memory (RAM), as well as the rapid development of fileless malware. Fileless malware is more likely to evade traditional detection methods on hard drives and does not leave traces on the disk (Khalid et al., 2023). However, when these malicious programs’ characteristic information is stored in RAM, their hidden data traces can be extracted from memory in an unencrypted and easily accessible format. Therefore, related research is actively exploring the optimal methods for volatile memory detection.

However, these studies also reveal a significant technological imbalance, resulting in insufficient attention to the study of data trace characteristics in persistent storage devices. A possible reason for this is that the data in persistent storage devices is typically based on the structural data of the operating system and file system, making it more appropriate to conduct data trace detection research at the file system and operating system stages rather than at the storage device stage. Additionally, the time sensitivity and complexity of memory, as well as the ongoing debate regarding the credibility of memory snapshots, have long been challenges in memory data investigation. The rapid evolution of fileless malware also makes it difficult for existing memory forensics methods to adapt to new attack techniques. Therefore, although memory forensics holds significant potential in combating modern malware, the technology’s refinement and adaptability still require continuous testing and improvement in practical applications.