CT-ER: An Analysis of Distributed Timestamps for Computer Forensic Investigations

点击翻译按钮获取中文摘要

The goal of this project is to gain better insights and procedures in the area of timestamp analysis for computer forensics investigations.Timestamps are used frequently in the investigations of computer incidents and also when analyzing digital evidence related to real-life crimes. They are used to establish the order of events that occurred on a computer, or to tie virtual events to those in the real world. The time-lining of events is common practice in the analysis of digital evidence. However, computer clocks may differ from the ``real time'', and they continuously drift ``away'' from that time, depending on the quality of those clocks. The consequences of these phenomena for a forensic investigation are yet unknown.This research extends an existing model to correlate timestamps, which is based on having available complete information about a clock. Given a timestamp found on a computer, the investigator wants to map it to a reference time. This research expands on the basic model, so that error or uncertainty rates can be established, different scenarios of what might have happened on a computing device may be conjectured and analyzed, the ordering of events can be taken into account, and time information that may have originated from external clocks can be considered.This project advances our understanding of how timed events relate to each other in distributed computing systems. It enables us to order events from disparate sources of digital evidence and quantify the error rate or uncertainty that arises due to granularity and accuracy constraints.