CT-ER: An Analysis of Distributed Timestamps for Computer Forensic Investigations

这个项目的目标是在计算机取证调查的时间戳分析领域获得更好的见解和程序。时间戳经常用于计算机事件的调查，也用于分析与现实生活中的犯罪有关的数字证据。它们被用来建立计算机上发生的事件的顺序，或者将虚拟事件与现实世界中的事件联系起来。事件的时间线是数字证据分析中的常见做法。然而，计算机时钟可能与“实时”不同，它们会不断地偏离那个时间“偏离”，这取决于时钟的质量。这些现象对法医调查的影响尚不清楚。这项研究扩展了一个现有的模型来关联时间戳，该模型基于关于时钟的可用完整信息。给出在计算机上找到的时间戳，调查员想要将其映射到参考时间。该研究对基本模型进行了扩展，从而可以建立错误或不确定率，可以推测和分析计算设备上可能发生的不同场景，可以考虑事件的顺序，可以考虑可能来自外部时钟的时间信息。它使我们能够对来自不同数字证据来源的事件进行排序，并量化由于粒度和准确性限制而产生的错误率或不确定性。

The goal of this project is to gain better insights and procedures in the area of timestamp analysis for computer forensics investigations.Timestamps are used frequently in the investigations of computer incidents and also when analyzing digital evidence related to real-life crimes. They are used to establish the order of events that occurred on a computer, or to tie virtual events to those in the real world. The time-lining of events is common practice in the analysis of digital evidence. However, computer clocks may differ from the ``real time'', and they continuously drift ``away'' from that time, depending on the quality of those clocks. The consequences of these phenomena for a forensic investigation are yet unknown.This research extends an existing model to correlate timestamps, which is based on having available complete information about a clock. Given a timestamp found on a computer, the investigator wants to map it to a reference time. This research expands on the basic model, so that error or uncertainty rates can be established, different scenarios of what might have happened on a computing device may be conjectured and analyzed, the ordering of events can be taken into account, and time information that may have originated from external clocks can be considered.This project advances our understanding of how timed events relate to each other in distributed computing systems. It enables us to order events from disparate sources of digital evidence and quantify the error rate or uncertainty that arises due to granularity and accuracy constraints.