The Phases Based Approach for Regeneration of Timeline in Digital Forensics

The field of digital forensics has developed to enable security experts to look at proof from the expanding plenty of computerized gadgets to help figure out what people may have done before. In this paper, we present a methodology based on the abstraction of information provided about the timeline of events and artefacts at four different levels such as event high level, event low level, artefact high level and artefact low level for the enhancement of timeline analysis. In our approach, two command-based digital forensics tools are also used such as log2timeline and psort to collect data from various files systems found on the typical computer for implementing the developed methodology. From results, it is observed that developed methodology can enhance the timeline of events and artefacts by increasing the visualization of the timeline, realistic of data and minimize the time utilized for collection and understanding of digital evidence from digital devices.