A Framework for Enhanced Timeline Analysis in Digital Forensics

Nowadays, with the growing number of storage devices and increasing popularity of digital hand-held devices on the Internet of Things (iThings), performing a digital forensic analysis is becoming gradually more problematic especially on the future generation Internet. One of the common solutions is the creation of computer activity timelines. This paper describes the existing tools and practices of timeline analysis with the conclusion that there is a need for a solid timeline analysis tool. Thus, it studies an existing but discontinued project (Zeitline), presents its features and shortcomings, and develops new capabilities to overcome these limitations. Finally, there is a discussion over the project's successes and failures, and an outline of its potential future improvements.