SLAMorris Final Thesis After Corrections.pdf - Cranfield University

However whilst this technique currently assists analysts it is possible that
criminals may use such knowledge; when creating their software they may
make the times involved in the events further apart to simulate human
interaction. The thumbnail cache also shows user involvement as most caches
of this type only add information when it is viewed by the user. Whilst the times
stored within the thumbnail cache vary in meaning they can be a useful source
of information for event reconstruction, providing information on when a file was
created or in some caches when the entry was added.
To reconstruct a set of events to form an accurate timeline, an analyst needs to
establish the time interval in which each event may have occurred. Time is a
construct which is said to have been established to assist the functioning of
society [Duren, 2002]; in forensic computing this construct allows an analyst to
define when events happen, to create an order in which events were completed.
To enable a global definition of time it is necessary to establish a ‘trusted’ time
to which events can be related, this is known as UTC time. Such a system is
particularly useful in establishing the order of events in forensic computing; it is
possible an event relevant to a case could have occurred anywhere in the
world. Therefore it may be necessary to link activities between two or more time
zones. Since it is difficult to measure time exactly, an event is often modelled as
an instantaneous action in event reconstruction models [Gladyshev, 2004]. An
analyst needs to understand how time is modelled to ensure he understands
the relationship between the time shown and its meaning.
Whilst timestamps are generally recognised as showing periods when the user
has been active, they can also assist in identifying periods of inactivity [Stone-
Kaplan, 2003]. Inactivity can be important in establishing the behaviour of the
user who created the evidence and also in linking evidence to a particular user,
for example the inactivity may correlate to when a user’s family were at home
Page 28