CT-ER: An Analysis of Distributed Timestamps for Computer Forensic Investigations

该项目的目标是在计算机取证调查的时间戳分析领域获得更好的见解和程序。时间戳经常用于计算机事件的调查，也用于分析与现实生活中的犯罪相关的数字证据。它们用于建立计算机上发生的事件的顺序，或将虚拟事件与真实的世界中的事件联系起来。对事件进行时间排序是分析数字证据的常见做法。然而，计算机时钟可能与"真实的时间“不同，并且它们不断地偏离那个时间，这取决于那些时钟的质量。这些现象对法医调查的影响尚不清楚。本研究扩展了现有的模型来关联时间戳，该模型基于有关时钟的完整信息。给定在计算机上发现的时间戳，调查人员希望将其映射到参考时间。本研究在基本模型的基础上进行了扩展，从而可以建立错误率或不确定率，可以对计算设备上可能发生的不同场景进行建模和分析，可以考虑事件的顺序，并且可以考虑可能源自外部时钟的时间信息。本项目推进了我们对分布式计算系统中定时事件如何相互关联的理解。它使我们能够从不同的数字证据源中排序事件，并量化由于粒度和准确性限制而产生的错误率或不确定性。

The goal of this project is to gain better insights and procedures in the area of timestamp analysis for computer forensics investigations.Timestamps are used frequently in the investigations of computer incidents and also when analyzing digital evidence related to real-life crimes. They are used to establish the order of events that occurred on a computer, or to tie virtual events to those in the real world. The time-lining of events is common practice in the analysis of digital evidence. However, computer clocks may differ from the ``real time'', and they continuously drift ``away'' from that time, depending on the quality of those clocks. The consequences of these phenomena for a forensic investigation are yet unknown.This research extends an existing model to correlate timestamps, which is based on having available complete information about a clock. Given a timestamp found on a computer, the investigator wants to map it to a reference time. This research expands on the basic model, so that error or uncertainty rates can be established, different scenarios of what might have happened on a computing device may be conjectured and analyzed, the ordering of events can be taken into account, and time information that may have originated from external clocks can be considered.This project advances our understanding of how timed events relate to each other in distributed computing systems. It enables us to order events from disparate sources of digital evidence and quantify the error rate or uncertainty that arises due to granularity and accuracy constraints.