Date of Award
Master of Science
Department of Electrical and Computer Engineering
Gilbert L. Peterson, PhD.
A file's provenance is a detailing of its origins and activities. There are tools available that are useful in maintaining the provenance of a file. Unfortunately for digital forensics, these tools require prior installation on the computer of interest while provenance generating events happen. The presented tool addresses this by reconstructing a file's provenance from several temporal artifacts. It identifies relevant temporal and user correlations between these artifacts, and presents them to the user. A variety of predefined use cases and real world data are tested against to demonstrate that this software allows examiners to draw useful conclusions about the provenance of a file.
DTIC Accession Number
Good, Ryan A., "AutoProv: An Automated File Provenance Collection Tool" (2017). Theses and Dissertations. 1574.