The Trojan Made Me Do It: A First Step in Statistical Based Computer Forensics Event Reconstruction
Megan Carney, Marc Rogers · 2004
The current study was exploratory and represents a first attempt at a standardized method for digital forensics event reconstruction based on statistical significance at a given error rate (α =.01). The study used four scenarios to test the ability to determine whether contraband images located on a system running Windows XP, were intentionally downloaded or downloaded without the user’s consent or knowledge. Seven characteristics or system variables were identified for comparison; using a stepwise discriminant analysis, the seven characteristics were reduced to four. It was determined that a model consisting of two characteristics, average of the difference between file creation times, and median of the difference between file creation times was the best model for discriminating the intentional action at α =.01. The implications of this finding and suggestions for future research are discussed. Event Reconstruction 3