SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges

Frank Breitinger, Hudan Studiawan, Chris Hargreaves

Event reconstruction is a technique that examiners can use to attempt to infer past activities by analyzing digital artifacts. Despite its significance, the field suffers from frag…