An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

Abstract

Digital forensics practitioners encounter numerous new terminologies during time-intensive digital investigation processes because of the explosive growth of the web, an immense amount of data, and rapid changes in technology. In such a scenario, the time needed to find and interpret the cause of the potential digital incident can be affected by the complexity involved in understanding the meaning of newly encountered terminologies. Although various approaches have been designed to assist digital practitioners in understanding the newly encountered terminologies during the investigation of the accident, none of them is capable of supporting investigators to interpret new terminologies. Our work focuses on reconstructing and analyzing the timeline of events and artifacts backed by the abstraction concept to help practitioners in reasoning about the perceived meaning of different digital forensics terminologies that are encountered during the investigation. This paper introduces an ontological approach based on the abstraction concept to reconstruct the timeline provided by command-based digital forensic tools, i.e., Log2timeline and Psort in the L2TCSV format, and assist in resolving the meaning of new encountered concepts. The performed experiments show that the novel methodology is capable of enhancing the timeline and assisting practitioners in determining the significance of encountered terminologies or concepts.

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…Therefore, manual timestamp inspections may no longer be adequate to support investigations. Some recent studies have applied other scientific methods to enhance temporal analysis such as visualization approach, such as using graph-based and ontology-based approaches [22], [23] and highlighting patterns in the timeline analysis [24], [25], [26].…”

AI in digital forensics: Ontology engineering for cybercrime investigations

“…It can be used for digital forensic event graph reconstruction. The timeline of cyber‐incidents can be efficiently generated using the ontological approach of Bhandari and Jusas, which utilizes purpose‐designed ontologies for Windows, Android, and iOS (Bhandari & Jusas, 2020).…”