Analysis of Evidence Using Formal Event Reconstruction

TL;DR

This paper introduces a formal method using finite state machines to analyze digital evidence, enabling testing of evidential statements against system models, demonstrated through a case study.

Contribution

It presents a novel modeling approach for system and evidential statements within a finite state machine framework for evidence analysis.

Findings

Method supports feasibility testing of statements against system models

New modeling technique enhances formal evidence analysis

Case study validates the proposed approach

Abstract

This paper expands upon the finite state machine approach for the formal analysis of digital evidence. The proposed method may be used to support the feasibility of a given statement by testing it against a relevant system model. To achieve this, a novel method for modeling the system and evidential statements is given. The method is then examined in a case study example.