A Digital Forensic View of Windows 10 Notifications

Round 1

Reviewer 1 Report

Rewrite section 1 with summarized it

Merge section (1.1. Motivation and contributions) with section 1

Experimental Results need to rewrite with add more analysis

The writing style of this manuscript should be improved

Author Response

We want to thank the reviewer for his comments and suggestions. Please find our answers and comments in the attached file.

Author Response File: Author Response.pdf

Reviewer 2 Report

Comments on the file below.

Comments for author File: Comments.docx

Author Response

We want to thank the reviewer for his insightful comments and suggestions that allowed improve our work. Please find our answers and comments in the attached file.

Author Response File: Author Response.docx

Reviewer 3 Report

Referencing could be more accurate and unified – sometimes whole name is written, sometimes only the surname.

Overall, I suggest authors to work on the literature review and look into international literature

I believe that this paper will be of interest to the readership of your journal, becouse from digital forensic perspective Windows notifications can harbor data that might be relevant to forensic investigations of Windows 10 devices and user(s).

Comments for author File: Comments.doc

Author Response

We want to thank the reviewer for his insightful comments and suggestions that allowed improve our work. Please find our answers and comments in the attached file.

Author Response File: Author Response.docx

Reviewer 4 Report

1. Author did not address problem clearly , existing methods limitations did not well analyzed.
2. lack of literature ,consider the recently work.
3. figure 2 and 3 need more detail explanation.
4. Databases  need more detail each parameter.
5. experiments setting and parameters should be discuss in detail

Author Response

We want to thank the reviewer for his comments and suggestions. Please find our answers and comments in the attached file.

Author Response File: Author Response.docx

Round 2

Reviewer 1 Report

 Rewrite section 1 with summarized it

 Merge section (1.1. Motivation and contributions) with section 1

Experimental Results need to rewrite with add more analysis

Author Response

Reviewer: Rewrite section 1 with summarized it
Authors: This issue was already addressed in the manuscript provided after the first round of reviews. 

Reviewer: Merge section (1.1. Motivation and contributions) with section 1
Authors: Section 1.1 was already merged as suggested in the manuscript provided after the first round of reviews.

Reviewer: Experimental Results need to rewrite with add more analysis
Authors: To clarify our results, we’ve added the following text to section 3.3:

“Toast payloads are definitely the most interesting ones as they can come from messaging applications such as Facebook Messenger or Microsoft Outlook, and Google Calendar, just to name a few. This can yield valuable information, as an email notification from Microsoft Outlook holds the sender and the initial part of the subject. The same goes for Facebook Messenger toasts that identify the sender and hold the initial part of the message. Obviously, the amount of data is limited, and as stated earlier, its usefulness is limited and restricted to scenarios where other sources of forensic data are not available.”

Reviewer 4 Report

All comments are well addresses

Author Response

We’d like to thank the reviewer for taking time to read our work and his positive feedback.