DOI: 10.5281/zenodo.17064467
title: Guidelines and Questionnaires for a User Study on Live Timestamp Tampering in Digital Forensic Event Reconstruction

description: This dataset comprises the questionnaires and guidelines used in a user study on live timestamp tampering. 

In this user study, participants were asked to complete questionnaires, participate in interviews, and perform a tampering task, in which they acted as adversaries attempting to swap two events that occurred on a computer to cover their tracks. This dataset includes all materials to reproduce this user study: a pre-tampering questionnaire to assess participants' backgrounds, instructions for the tampering task scenario, a post-tampering questionnaire to capture participants' strategies and reflections, and semi-structured interview guidelines. 

This repository does not contain any actual results of this project but only the necessary details to reproduct this user study on live tampering. 

The structure and details of the user study guidelines and questionnaires uploaded in this repository can be found in the README.txt file.
description: Timestamps play a pivotal role in digital forensic event reconstruction, yet their non-essential nature makes them vulnerable to tampering, even on running systems. This vulnerability impacts the reliability of the timeline of events during investigations. While in some cases inconsistencies may reveal tampering, distinguishing intentional manipulation from alternative causes, such as system errors, remains challenging. A solid understanding of adversarial tampering behaviors is therefore essential for digital forensic investigators to evaluate the effect of such actions on the meaning and interpretation of evidence. 

In this project, we investigated the problem of users tampering with timestamps on a running (“live”) system. We conducted a qualitative user study with 10 advanced university students, who tampered with a live system based on a fictitious scenario in where a regular user attempts to swap two events to cover their tracks. While prior work has demonstrated the inherent difficulty of digital evidence tampering is hard, our focus was to explore why this is so. Our primary objective was to understand how participants design their strategies and allocate resources while solving a live timestamp tampering task. This exploration also shed lights on the difficulties of tampering with specific artifacts. These insights can help develop further strategies for reliable event reconstruction, for example when investigators have to interpret contradicting artifacts. 

Overall, we had the following research questions: (RQ1) Approach to tampering: What strategies do adversaries employ in planning and executing tampering with the temporal order of events? (RQ2) Awareness and precautions of the traces left by the manipulation: How do adversaries deal with (new) traces stemming from their manipulations? (RQ3) Barriers to the tampering process: What makes an artifact more difficult to tamper with compared to another?

This project resulted in the following publication: C. Vanini, J. Gruber, C. J. Hargreaves, Z. Benenson, F. Freiling, F. Breitinger,  2025. Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction. In Proceedings of the Digital Forensics Doctoral Symposium (DFDS ’25). Association for Computing Machinery, New York, NY, USA, Article 10, 1–8. https://doi.org/10.1145/3712716.3712727.

Through this user study, we demonstrated that participants distinguish between direct traces of their tampering actions within the manipulated artifact and second-order traces that are indirect indicators of tampering, such as traces of anti-forensic tools usage. Participants adapted their tampering strategies accordingly.  Additionally, we identified strategies of live tampering that involve the opportunistic application of tampering actions along the hierarchical abstraction layers. This indicates the mental application of a tampering budget, with a focus on artifacts that are easier to manipulate, Finally, we gained a deeper understanding of the reliability of tampering indicators and derived factors that influence the tamper resistance of an artifact, such as the existence of integrity checks within the artifact.