Timestamp evidence correlation by model based clock hypothesis testing

e-Forensics 2008 - Proceedings of the 1st International Conference on Forensic Applications and Techniques in Telecommunications, Information, and Multimedia and Workshop

Volumn , Issue , 2008, Pages

  Willassen, Svein Yngvar ^a  

^a NORWEGIAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Norway)

Author keywords

Clock hypothesis; Digital investigation; Event logic

Indexed keywords

DIGITAL INVESTIGATION; EVENT LOGIC; EVIDENCE CORRELATION; HYPOTHESIS TESTING; MODEL-BASED OPC; NETWORK TRACING; TIME STAMPS; TIME-STAMP;

CLOCKS;

EID: 84881148080     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.4108/e-forensics.2008.2637     Document Type: Conference Paper

References (5)

1. B. Carrier, "A hypothesis-based approach to digital forensic investigations," Center for Education and Research in Information Assurance and Security, Purdue University Tech Report 2006-06, 2006.
2. B. Schatz, G. Mohay, and A. Clark, "A correlation method for establishing provenance of timestamps in digital evidence," Digital Investigation, vol. 2006:3S, pp. 98-107, 2006.
3. F. Buchholz and B. Tjaden, "A brief study of time," Digital Investigation, vol. 2007:4S, pp. 31-42, 2007.
4. S. Y. Willassen, "Hypothesis based investigation of digital timestamps," in IFIP WG 11.9 Workshop, Kyoto, Japan, 2008.
5. B. Carrier, File system forensic analysis. Upper Saddle River, N.J.: Addison-Wesley, 2005.