Time Line Analysis in Digital Forensics

Time lines are an essential part of forensic analysis. Reconstructing the event sequence around an incident of interest is vital to virtually any resolution, regardless of the venue. A private enterprise may be concerned about prevention and thus focus on identifying an attack path and vulnerabilities. In contrast, law enforcement, would be concerned with identifying a suspect and preserving evidence for potential prosecution. In both cases, however, an accurate and credible time line is necessary. Without knowing the order in which events occurred, an enterprise could have trouble identifying how unauthorized access was gained. Without an accurate chronology, law enforcement couldn't map suspects' actions to the o ense. Investigation of a digital event is no exception. The digital environment, however, does present unique challenges.