DOI: 10.5281/zenodo.17122741
title: Time anchoring artifacts for digital forensic event reconstruction

description:  

This dataset is an ensemble of artifacts extracted from four Windows disk images, analyzed and discussed in the following paper: C. Vanini, C. J. Hargreaves, H. van Beek, F. Breitinger, 2024. Was the Clock Correct? Exploring Timestamp Interpretation Through Time Anchors for Digital Forensic Event Reconstruction. Forensic Science International: Digital Investigation, 49, 301759. https://doi.org/10.1016/j.fsidi.2024.301759.

This paper deals with timestamp interpretation and addresses the problem of incorrect clocks. When this system time is skewed due to tampering, natural clock drift, or system malfunctions, recorded timestamps will not reflect the actual times the (real-world) events occurred.

These disk images were created as part of two multi-part controlled experiments that illustrate the application of concepts defined in the paper. For this work, only the following artifacts were extracted and are included in this dataset: the Google Chrome History database, Google Chrome cache files, and several Windows Event Logs. These artifacts contain what we refer to as `time anchors' or `time anomalies' and can be used to assess the correctness of system clocks.
description: This project was conducted jointly with the NFI and the University of Oxford as part of a thesis research. The idea was to develop a methodology to assess the correctness of system clocks for timelining and event reconstruction. 

A correct timestamp interpretation is essential for reconstructing events, particularly when the goal is to determine the sequence in which the events occurred (i.e., timeline of events). Although the origin of timestamps varies, many are derived from the internal clock of computer hardware. However, this so-called `system time' does not always reflect the time in the real world.  The causes of these differences are diverse, including factors such as clock drift, malfunctioning, or arbitrary changes. 

This problem motivated the development of a holistic approach to assess the correctness of system clocks and determine any system clock skew. 

This project resulted in the following publication: C. Vanini, C. J. Hargreaves, H. van Beek, F. Breitinger, 2024. Was the Clock Correct? Exploring Timestamp Interpretation Through Time Anchors for Digital Forensic Event Reconstruction. Forensic Science International: Digital Investigation, 49, 301759. https://doi.org/10.1016/j.fsidi.2024.301759.

 

Results

In this research, we formalized the concept of time anchors which can be used to show the correctness of the system clock at a specific time in a device’s history. This concept is complemented by different types of events, e.g., anchoring (a Google search) and non-anchoring events (a file creation), which have major implications for the uncertainty that remains after the approach is used. 

With respect to the latter, we also defined time anomalies which can be used to increase confidence in clock accuracy in scenarios involving non-anchoring events. The practicality of these concepts has been demonstrated based on two examples. Time anomalies and time anchoring artifacts used in these examples are stored in this repository. Lastly, this article includes several examples of time anchors and categorizations, making additional types of time anchors easier to identify.