Creating Super Timelines in Windows Investigations
Document Type
Conference Proceeding
Publication Date
2013
Abstract
As the applications and adoption of networked electronic devices grow, their use in conjunction with crimes also increases. Extracting probative evidence from these devices requires experienced digital forensic practitioners to use specialized tools that help interpret the raw binary data present in digital media. After the evidentiary artifacts are collected, an important goal of the practitioner is to assemble a narrative that describes when the events of interest occurred based on the timestamps of the artifacts. Unfortunately, generating and evaluating super timelines is a manual and labor-intensive process. This paper describes a technique that aids the practitioner in this process by generating queries that extract and connect the temporal artifacts, and produce concise timelines. Application of the queries to a simulated incident demonstrates their ability to reduce the number of artifacts from hundreds of thousands artifacts to a few hundred or less, and to facilitate the understanding of the activities surrounding the incident. Abstract © IFIP
DOI
10.1007/978-3-642-41148-9_9
Source Publication
IFIP Advances in Information and Communication Technology, v.410
Recommended Citation
Esposito, S., Peterson, G. (2013). Creating Super Timelines in Windows Investigations. In: Peterson, G., Shenoi, S. (eds) Advances in Digital Forensics IX. Digital Forensics 2013. IFIP Advances in Information and Communication Technology, vol 410. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-41148-9_9
Comments
© IFIP International Federation for Information Processing 2013
The "Link to Full Text" on this page loads the PDF of the chapter, furnished open-access through the Springer Nature SharedIt content-sharing initiative. The publisher retains permissions to re-use and distribute this chapter from IFIP v.410.