Skip to main content
Article
CAT detect (computer activity timeline detection): A tool for detecting inconsistency in computer activity timelines
Digital Investigation
  • Andrew Marrington, Zayed University
  • Ibrahim Baggili, Zayed University
  • George Mohay, Queensland University of Technology QUT
  • Andrew Clark, Queensland University of Technology QUT
Document Type
Conference Proceeding
Publication Date
1-1-2011
Abstract

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies. © 2011 Marrington, Baggili, Mohay & Clark. Published by Elsevier Ltd. All rights reserved.

Publisher
Elsevier Ltd
Disciplines
Keywords
  • CAT detect,
  • Event correlation,
  • Happened-before,
  • Precondition event,
  • Timeline inconsistency
Scopus ID

79961063586

Creative Commons License
Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International
Indexed in Scopus
Yes
Open Access
Yes
Open Access Type
Hybrid: This publication is openly available in a subscription-based journal/series
Citation Information
Andrew Marrington, Ibrahim Baggili, George Mohay and Andrew Clark. "CAT detect (computer activity timeline detection): A tool for detecting inconsistency in computer activity timelines" Digital Investigation Vol. 8 Iss. SUPPL. (2011) p. S52 - S61 ISSN: <p><a href="https://v2.sherpa.ac.uk/id/publication/issn/1742-2876" target="_blank">1742-2876</a></p>
Available at: http://works.bepress.com/andrew-marrington/23/