An automated timeline reconstruction approach for digital forensic investigations
详细信息 查看全文
- 作者：Christopher Hargreaves ; Jonathan Patterson
- 关键词：Digital forensics ; Automation ; Timelines ; Event reconstruction ; Forensic computing ; Timest Visualisation
- 刊名：Digital Investigation
- 出版年：2012
- 出版时间：August, 2012
- 年：2012
- 卷：9
- 期：supp_S
- 页码：S69-S79
- 全文大小：951 K
文摘
Existing work on digital forensics timeline generation focuses on extracting times from a disk image into a timeline. Such an approach can produce several million ¡®low-level¡¯ events (e.g. a file modification or a Registry key update) for a single disk. This paper proposes a technique that can automatically reconstruct high-level events (e.g. connection of a USB stick) from this set of low-level events. The paper describes a framework that extracts low-level events to a SQLite backing store which is automatically analysed for patterns. The provenance of any high-level events is also preserved, meaning that from a high-level event it is possible to determine the low-level events that caused its inference, and from those, the raw data that caused the low-level event to be initially created can also be viewed. The paper also shows how such high-level events can be visualised using existing tools.