The IRMA Community
Newsletters
Research IRM
Click a keyword to search titles using our InfoSci-OnDemand powered search:
|
A Model Based Approach to Timestamp Evidence Interpretation
Abstract
Timestamps play an important role in digital investigations, since they are necessary for the correlation of evidence from different sources. Use of timestamps as evidence can be questionable due to the reference to a clock with unknown adjustment. This work addresses this problem by taking a hypothesis based approach to timestamp investigation. Historical clock settings can be formulated as a clock hypothesis. This hypothesis can be tested for consistency with timestamp evidence by constructing a model of actions affecting timestamps in the investigated system. Acceptance of a clock hypothesis with timestamp evidence can justify the hypothesis, and thereby establish when events occurred in civil time. The results can be used to correlate timestamp evidence from different sources, including identifying correct originators during network trace.
Related Content
|
Vivek Bhardwaj, Bilal Ahmed, Mirza Shuja, Deepak Thakur, Tanya Gera, Mukesh Kumar.
© 2026.
26 pages.
|
|
Vivek Bhardwaj, Tanima Thakur, Mrinalini Rana, Jeyaganesh Viswanathan.
© 2026.
24 pages.
|
|
Abhishek Sharma, Abhishek Mishra, Shweta Jain, Khushboo Karodiya, Priyanka Sharma.
© 2026.
10 pages.
|
|
Akash Mishra, Nandini Bansod, Dinesh Baban Kamble.
© 2026.
18 pages.
|
|
Anjali Rawat, George Kurian, Romil Rawat, Janet Olivia Richmond, Anand Rajavat, Purvee Bhardwaj.
© 2026.
28 pages.
|
|
Antonio Gonzalez-Torres.
© 2026.
26 pages.
|
|
Anjali Rawat, A. Samson Arun Raj, Janet Olivia Richmond, Anand Rajavat, Antonio González-Torres, Purvee Bhardwaj.
© 2026.
22 pages.
|
|
|