AF-002 Reproducibility Dataset: Selective Browser History Removal

This dataset contains the primary forensic artifacts for AF-002, a reproducibility case for detecting selective browser history removal in Google Chrome on Windows 10. AF-002 models a scenario in which visited URL entries are deleted from the Chrome History SQLite database while residual evidence remains in the filesystem and NTFS change journal. The inconsistency is detected by correlating Chrome History content with filesystem traces in MFT and modification evidence in UsnJrnl:J. The expected detection outcome is that AF-002 should fire when browser-history absence is contradicted by IndexedDB-related filesystem traces and journal modification indicators. Included files in this version are: af002_history_post, the post-tampering Chrome History artifact; af002_mft, the raw NTFS Master File Table artifact; af002_usn_J, the raw NTFS USN change journal artifact; af002_mft.csv, the parsed MFT export used to identify IndexedDB-related traces associated with visited domains; and af002_usn_J.csv, the parsed USN export used to identify modification indicators affecting the Chrome History database. The Chrome History artifact was collected as a copied SQLite database, while NTFS artifacts were extracted from the source image and parsed into CSV using MFTECmd-compatible forensic workflow for reproducible downstream mapping and validation in the IoI framework. Scenario summary: platform Windows 10; application Google Chrome; manipulation selective deletion of visited-site records from Chrome History; expected inconsistency browser-history evidence is removed from SQLite while residual traces remain in filesystem and journal artifacts. Related framework resources: framework repository https://github.com/ioi-framework/ioi-framework ; case materials https://github.com/ioi-framework/ioi-framework/tree/main/CASES/AF-002 ; website case page https://ioi-framework.github.io/cases/af-002/ This record is intended as a versioned reproducibility dataset for the AF-002 case and may be updated in future Zenodo versions as additional documentation, checksums, manifests, or companion derived files are added.本数据集涵盖AF-002的核心取证工件，该案例为Windows 10系统上谷歌浏览器（Google Chrome）选择性浏览器历史记录删除行为的可复现检测案例。 AF-002构建了如下模拟场景：用户从Chrome历史记录SQLite数据库中删除已访问的URL条目，但文件系统与NTFS更改日志中仍残留相关证据。通过将Chrome历史记录内容与主文件表（Master File Table，MFT）中的文件系统痕迹、以及UsnJrnl:J中的修改证据进行关联，可识别此类不一致现象。预期检测判定结果为：当浏览器历史记录缺失的情况与索引数据库（IndexedDB）相关的文件系统痕迹及日志修改指标相矛盾时，AF-002应触发检测。 本版本收录的文件包括：af002_history_post——篡改后的Chrome历史记录取证工件；af002_mft——原始NTFS主文件表取证工件；af002_usn_J——原始NTFS USN更改日志取证工件；af002_mft.csv——经解析的MFT导出文件，用于识别与已访问域名相关的索引数据库（IndexedDB）痕迹；af002_usn_J.csv——经解析的USN导出文件，用于识别影响Chrome历史记录数据库的修改指标。 Chrome历史记录取证工件以复制得到的SQLite数据库形式采集，而NTFS取证工件则从源镜像中提取，并通过兼容MFTECmd的取证工作流解析为CSV格式文件，以支持在IoI框架中开展可复现的下游映射与验证工作。 场景概要：操作系统为Windows 10；应用程序为谷歌浏览器；操作内容为从Chrome历史记录中选择性删除已访问站点记录；预期不一致现象表现为：SQLite数据库中的浏览器历史记录已被删除，但文件系统和日志工件中仍存在残留痕迹。 相关框架资源：框架仓库https://github.com/ioi-framework/ioi-framework；案例材料https://github.com/ioi-framework/ioi-framework/tree/main/CASES/AF-002；网站案例页面https://ioi-framework.github.io/cases/af-002/ 本记录为AF-002案例的版本化可复现数据集，后续Zenodo版本将视情况新增补充文档、校验和、清单或配套衍生文件并更新。