Best Paper Award for Beyond Timestamps (DFRWS USA)

2024-07-15

Excited to share that our paper “Beyond Timestamps: integrating Implicit Timing Information into Digital Forensic Timelines” received the prestigious DFRWS USA Best Paper Award. Thanks to all my co-authors: Lisa Marie Dreier, Céline Vanini, Christopher Hargreaves and Felix Freiling.

Abstract

Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical ``flat'' timeline is thereby extended into a ``rich'' partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.

Lisa Marie Dreier, Céline Vanini, Christopher J. Hargreaves, Frank Breitinger, Felix Freiling: Beyond timestamps: Integrating implicit timing information into digital forensic timelines. In: Forensic Science International: Digital Investigation, vol. 49, pp. 301755, 2024, ISSN: 2666-2817, (DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA).