An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics

Abstract

Acquiring a clear perspective of events and artefacts that occur over time is a challenging objective to accomplish in digital forensics. Reconstruction of the timeline of events and artefacts, which enables digital investigators to understand the timeline of digital crime and interpret the conclusion in the form of digital evidence, is one of the most paramount and challenging tasks in digital forensics. This challenging task requires the analysis of immense amounts of events because of the explosive growth of the internet, interconnected devices, and innovative technology nowadays. Various approaches have been developed during the last decade, but most of them are not able to handle huge volumes of data, explore evidence, and enhance the understandability of timelines in a competent way to assist the investigator. For this purpose, we introduce a methodology backed by an abstraction concept and forensic tools that can support investigators during the reconstruction, understanding of the timeline of events and artefacts, and interpretation of evidence by tracing the activities performed by users of the typical computer system. The Java programming language is used to implement the proposed methodology, which is object-oriented and follows the symmetry definition in software. Generally, symmetry in software can be viewed as an invariant change that aims to preserve a specific property of the system, namely its structure, behaviour, regularity, similarity, familiarity and uniformity. Similarly, the abstraction-based methodology also permits us to follow the properties of symmetry. For instance, a uniform structure is stipulated for all the sources at the particular level of abstraction, such as the number of fields to be considered to provide the abstract level of timeline. The primary purpose of this approach is to assist with the analysis of the timeline in an optimum way. This paper illustrates the approach and then focuses on conceptual aspects of the methodology. The performed experiment shows that the proposed approach enhanced the analysis of the timeline.

An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

“…In this section, the first methodology for reconstruction of the timeline in digital forensics [26] is discussed. This approach is based on the outcome of the digital forensics command based tools, i.e., Log2timeline and Psort.…”

Digital Forensics Challenges in Cyberspace: Overcoming Legitimacy and Privacy Issues Through Modularisation

“…Lack of standardisation of hardware, software, techniques, and policies surrounding cloud forensics [32] across industries and several countries brought in the challenge of evidence dependability and soundness, which are acquired using those tools and policies. Several unsuccessful attempts have been made to create new formats and abstractions [33][34] when representing an individual's whole life's data in a few bytes of information informing signature pen tester metrics, user profiles, and filesystem metadata. It may be difficult and practically impossible to standardise all the digital forensic tools, models, and processes due to some form of diversity in the procedures.…”

Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events

“…Timeline2GUI was developed to analyse * .csv log files created by log2timeline [26]. An abstraction based approach for timeline reconstruction was proposed in 2020, which is based on the timeline data provided by log2timeline [27].…”