Towards designing a tool for event reconstruction using Gladyshev Approach
Merin Sebastian, Priya Chandran · 2011
Event reconstruction is the process that explains the 'how' and 'why' of an evidence in a digital investigation. Formalization of this process is essential because the evidence is of legal value which requires a logical reasoning. A finite state machine approach and formalization of the event reconstruction problem had been proposed by Gladyshev. The authors present their model for a tool for event reconstruction built upon Gladyshev formalization. The model is formulated by analyzing a case study, of hidden/deleted files, and forms the first step towards the design of a generic tool for event reconstruction.