Low level events • Low level timelines • High level events ... - DFRWS

Recommendations

Info

Low-level event format: provenance dataprov_source /Users/Chris/NTUSER.DAT dataprov_type offset dataprov_value 274784
Currently identified data provenance • offset, e.g. in a Registry hive, index.dat, $mft • sql statement, e.g. places.sqlite • line number, e.g. setupapi.log
Page 1: An automated timeline reconstructio
Page 4 and 5: Research Aim • What is the ‘gis
Page 6 and 7: Research Aim Summary • Needs to p
Page 8 and 9: Aftertime Netherlands Forensic Inst
Page 10 and 11: Existing Work on Timelines: Cyber F
Page 12 and 13: Overview of our approach high-timel
Page 14 and 15: Low-level time extraction Extractor
Page 16 and 17: Extractor Manager can match on file
Page 20 and 21: We have a SQLite database containin
Page 22 and 23: hypothesis trigger event Analysis C
Page 24 and 25: Simple test events
Page 26 and 27: ...but searches are more powerful i
Page 29 and 30: More Complex Event Matching
Page 31 and 32: YouTube example test events Patters
Page 33 and 34: Supporting and contradictory artefa
Page 35 and 36: Case folder structure
Page 37 and 38: Performance
Page 39: https://github.com/FlowingMedia/Tim
Page 44 and 45: d3.js used to show high and support
Page 46 and 47: Can link to files associated with t
Page 48 and 49: Evaluation (1) • Demonstrated as
Page 50 and 51: Future Work • More extractors inc

Low level events • Low level timelines • High level events ... - DFRWS

Create successful ePaper yourself

Delete template?

Save as template?