Main Article Content
Abstract
Research discusses one of the files system in the operating Linux system, which Ext4 (Extended Fourth) which is a continuation of the Ext2 and Ext3. The method used in this study is the forensic investigation is to collect, maintain, and analyze. This study was conducted with a simulation file. Results from this study is a file can be known when the file is created to be modified. This study also uses some Linux default tool nor a forensic tool.