Low level events • Low level timelines • High level events ... - DFRWS

Recommendations

Info

<strong>Low</strong>-<strong>level</strong> time extraction Extractor Manager (file name, path, content) Bridge Parser
Extractor Manager can match on file name/path
Page 1: An automated timeline reconstructio
Page 4 and 5: Research Aim • What is the ‘gis
Page 6 and 7: Research Aim Summary • Needs to p
Page 8 and 9: Aftertime Netherlands Forensic Inst
Page 10 and 11: Existing Work on Timelines: Cyber F
Page 12 and 13: Overview of our approach high-timel
Page 16 and 17: Extractor Manager can match on file
Page 18 and 19: Low-level event format: provenance
Page 20 and 21: We have a SQLite database containin
Page 22 and 23: hypothesis trigger event Analysis C
Page 24 and 25: Simple test events
Page 26 and 27: ...but searches are more powerful i
Page 29 and 30: More Complex Event Matching
Page 31 and 32: YouTube example test events Patters
Page 33 and 34: Supporting and contradictory artefa
Page 35 and 36: Case folder structure
Page 37 and 38: Performance
Page 39: https://github.com/FlowingMedia/Tim
Page 44 and 45: d3.js used to show high and support
Page 46 and 47: Can link to files associated with t
Page 48 and 49: Evaluation (1) • Demonstrated as
Page 50 and 51: Future Work • More extractors inc

Low level events • Low level timelines • High level events ... - DFRWS

Create successful ePaper yourself

Delete template?

Save as template?