Computer Forensic Timeline Visualization Tool

Document type: Journal Articles
Article type: Original article
Peer reviewed: Yes
Author(s): Jens Olsson, Martin Boldt
Title: Computer Forensic Timeline Visualization Tool
Journal: Digital Investigation
Year: 2009
Volume: 6
Issue: Supplement 1
Pagination: 78-87
ISSN: 1742-2876
Publisher: Elsevier
URI/DOI: 10.1016/j.diin.2009.06.008
ISI number: 000269484800010
Organization: Blekinge Institute of Technology
Department: School of Computing (Sektionen för datavetenskap och kommunikation)
School of Computing S-371 79 Karlskrona
+46 455 38 50 00
Authors e-mail:,
Language: English
Abstract: Computer Forensics is mainly about investigating crime where computers have been involved. There are many tools available to aid the investigator with this task. We have created a prototype of a new type of tool called CyberForensic TimeLab where all evidence is indexed by their time variables and plotted on a timeline. We believed that this way of visualizing the evidence allows the investigators to find coherent evidence faster and more intuitively. We have performed a user test where a group of people has evaluated our prototype tool against a modern commercial computer forensic tool and the results of this preliminary test are very promising. The results show that users completed the task in shorter time, with greater accuracy and with less errors using CyberForensic TimeLab. The subjects also experienced that the prototype were more intuitive to use and that it allowed them to easier locate evidence that was coherent in time.
Subject: Computer Science\Electronic security
Keywords: Computer forensic timeline, Event visualization, E-fraud, Timestamp, Chronological evidence, Time Variable, Time determination