Output details
12 - Aeronautical, Mechanical, Chemical and Manufacturing Engineering
Cranfield University
An automated timeline reconstruction approach for digital forensic investigations
This research presents a new technique for generating summaries of activity on hard disks obtained during criminal or civil investigation. This timeline reconstruction was co-funded by EPSRC (EP/H023135, total £2.2M) in collaboration with 8 other partners. Outputs have been adopted in our MSc in Forensic Computing and enabled additional publications, including Hargreaves (2013): Visualisation of unallocated blocks in block based files. A further output is a prototype tool to demonstrate the technique (PyDFT) which has been transferred to several law enforcement agencies around the world, and is scheduled for release as an open source project in 2014.