An automated timeline reconstruction approach for digital forensic investigations

作者：Hargreaves Christopher^*; Patterson Jonathan

来源：Digital Investigation, 2012, 9: S69-S79.

DOI：10.1016/j.diin.2012.05.006

• Digital forensics
• Automation
• Timelines
• Event reconstruction
• Forensic computing
• Timestamp
• Visualisation

Existing work on digital forensics timeline generation focuses on extracting times from a disk image into a timeline. Such an approach can produce several million %26apos;low-level%26apos; events (e.g. a file modification or a Registry key update) for a single disk. This paper proposes a technique that can automatically reconstruct high-level events (e.g. connection of a USB stick) from this set of low-level events. The paper describes a framework that extracts low-level events to a SQLite backing store which is automatically analysed for patterns. The provenance of any high-level events is also preserved, meaning that from a high-level event it is possible to determine the low-level events that caused its inference, and from those, the raw data that caused the low-level event to be initially created can also be viewed. The paper also shows how such high-level events can be visualised using existing tools.

• 出版日期2012-8