Low level events • Low level timelines • High level events ... - DFRWS

Recommendations

Info

Methods for matching MatchAnyTestEvent(self, dict_of_test_events) FindMatchingEventsinIdRange(self, start, end, test_events) FindEventsInSubTimeline(self, event_list, start, end) FindEventsRelatedToAPath(self, path)
YouTube example test events Patterson, J. & Hargreaves, C. (2011) Automated Identification and Reconstruction of YouTube Video Access, Proceedings from 5th Cybercrime Forensics Education and Training
Page 1: An automated timeline reconstructio
Page 4 and 5: Research Aim • What is the ‘gis
Page 6 and 7: Research Aim Summary • Needs to p
Page 8 and 9: Aftertime Netherlands Forensic Inst
Page 10 and 11: Existing Work on Timelines: Cyber F
Page 12 and 13: Overview of our approach high-timel
Page 14 and 15: Low-level time extraction Extractor
Page 16 and 17: Extractor Manager can match on file
Page 18 and 19: Low-level event format: provenance
Page 20 and 21: We have a SQLite database containin
Page 22 and 23: hypothesis trigger event Analysis C
Page 24 and 25: Simple test events
Page 26 and 27: ...but searches are more powerful i
Page 29: More Complex Event Matching
Page 33 and 34: Supporting and contradictory artefa
Page 35 and 36: Case folder structure
Page 37 and 38: Performance
Page 39: https://github.com/FlowingMedia/Tim
Page 44 and 45: d3.js used to show high and support
Page 46 and 47: Can link to files associated with t
Page 48 and 49: Evaluation (1) • Demonstrated as
Page 50 and 51: Future Work • More extractors inc

Low level events • Low level timelines • High level events ... - DFRWS

Create successful ePaper yourself

Delete template?

Save as template?