Beyond timestamps: Integrating implicit timing information into digital forensic timelines
Dreier LM, Vanini C, Hargreaves CJ, Breitinger F, Freiling F (2024)
Publication Language: English
Publication Type: Journal article
Publication year: 2024
Journal
Book Volume: 49
Article Number: 301755
URI: https://www.sciencedirect.com/science/article/pii/S266628172400074X
DOI: 10.1016/j.fsidi.2024.301755
Open Access Link: https://www.sciencedirect.com/science/article/pii/S266628172400074X?via=ihub
Abstract
Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical “flat” timeline is thereby extended into a “rich” partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.
Authors with CRIS profile
Lisa Marie Dreier
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
Felix Freiling
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
Related research project(s)
Involved external institutions
United Kingdom (GB)
Switzerland (CH)How to cite
APA:
Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F., & Freiling, F. (2024). Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49. https://doi.org/10.1016/j.fsidi.2024.301755
MLA:
Dreier, Lisa Marie, et al. "Beyond timestamps: Integrating implicit timing information into digital forensic timelines." Forensic Science International: Digital Investigation 49 (2024).
BibTeX: Download