Event Reconstruction: A State of the Art

Yoan Chabot (1) , Aurélie Bertaux (2) , Tahar Kechadi (3) , Christophe Nicolle (4)

1 Le2i - CheckSem
2 Le2i - Laboratoire Electronique, Informatique et Image [UMR6306]
3 School of Computer Science and Informatics [Dublin]
4 Checksem

Event reconstruction is one of the most important step in digital forensic investigations. It allows investigators to have a clear view of the events that have occurred over a time period. Event reconstruction is a complex task which requires exploration of a large amount of events due to the pervasiveness of new technologies nowadays. Any evidence produced at the end of the investigative process must also meet the requirements of the courts, such as reproducibility, verifiability, validation, etc. After defining the most important concepts of event reconstruction, we present a survey of the challenges of this field and solutions proposed so far.

Mots clés: Digital Forensic; Event Reconstruction

Domaines: Ordinateur et société [cs.CY]; Autre [cs.OH]

Yoan Chabot, Aurélie Bertaux, Tahar Kechadi, Christophe Nicolle. Event Reconstruction: A State of the Art. Handbook of Research on Digital Crime, Cyberspace Security, and Information Assurance, IGI Global, pp.15, 2014. ⟨hal-00955527⟩