Enhanced Timeline Analysis for Digital Forensic Investigations

Forensic analysis is the science of collecting, examining, and presenting evidence in order to support or refute a hypothesis. With the increasing size of storage devices and growing popularity of digital hand-held devices connecting to the Internet, performing an effective digital forensic investigation is becoming more challenging to investigators. In this article, we evaluate the existing tools of timeline analysis and identify the need for a solid timeline analysis tool. For this reason, the article studies an existing but discontinued project called Zeitline, presents its features and shortcomings, and develops new capabilities to overcome these limitations. A case study is then presented in which the application's functionality is tested.