Timestamp evidence correlation by model based clock hypothesis testing

Authors:
Svein Yngvar Willassen
Affiliations:
Norwegian University of Science and Technology, Trondheim, Norway
Venue:
Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Year:
2008

Citing 3
Cited 3

File System Forensic Analysis

File System Forensic Analysis
A brief study of time

Digital Investigation: The International Journal of Digital Forensics & Incident Response
A correlation method for establishing provenance of timestamps in digital evidence

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Towards event ordering in digital forensics

Proceedings of the 12th ACM workshop on Multimedia and security
CAT Detect (Computer Activity Timeline Detection): A tool for detecting inconsistency in computer activity timelines

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Hypervisor event logs as a source of consistent virtual machine evidence for forensic cloud investigations

DBSec'13 Proceedings of the 27th international conference on Data and Applications Security and Privacy XXVII

Quantified Score

Hi-index	0.00

Visualization

Abstract

Timestamps play an important role in digital investigations, since they are necessary for the correlation of evidence from different sources, including network tracing. Use of timestamps as evidence can be questionable due to the reference to a clock with unknown adjustment. This work addresses this problem by taking a hypothesis based approach to timestamp investigation. Historical clock values can be formulated as a clock hypothesis. This hypothesis can be tested for consistency with timestamp evidence by constructing a model of actions affecting timestamps in the investigated system. Acceptance of a clock hypothesis with timestamp evidence can justify the hypothesis, and thereby establish when events occurred in civil time. The results can be used to correlate timestamp evidence from different sources, including identifying correct originators during network trace.