Update Thresholds of More Accurate Time Stamp for Event Reconstruction

TL;DR

This paper presents a model and empirical analysis of timestamp update patterns in digital systems to improve the accuracy of event timing in digital investigations.

Contribution

It introduces a method to predict timestamp update time-spans and calculate their distribution for more precise event reconstruction.

Findings

Timestamp updates are not instantaneous.

A model predicts object update patterns.

Method improves accuracy of event timing.

Abstract

Many systems rely on reliable timestamps to determine the time of a particular action or event. This is especially true in digital investigations where investigators are attempting to determine when a suspect actually committed an action. The challenge, however, is that objects are not updated at the exact moment that an event occurs, but within some time-span after the actual event. In this work we define a simple model of digital systems with objects that have associated timestamps. The model is used to predict object update patterns for objects with associated timestamps, and make predictions about these update time-spans. Through empirical studies of digital systems, we show that timestamp update patterns are not instantaneous. We then provide a method for calculating the distribution of timestamp updates on a particular system to determine more accurate action instance times.