Event Reconstruction
Yoan Chabot, Aurélie Bertaux, Tahar Kechadi, Christophe Nicolle · Advances in digital crime, forensics, and cyber terrorism book series · 2014
Event reconstruction is one of the most important steps in digital forensic investigations. It allows investigators to have a clear view of the events that have occurred over a time period. Event reconstruction is a complex task that requires exploration of a large amount of events due to the pervasiveness of new technologies. Any evidence produced at the end of the investigative process must also meet the requirements of the courts, such as reproducibility, verifiability, validation, etc. After defining the most important concepts of event reconstruction, the authors present a survey of the challenges of this field and solutions proposed so far.