Computer Forensics is mainly about investigating crime where computers have been involved. There are many tools available to aid the investigator with this task. We have created a prototype of a new type of tool called CyberForensic TimeLab where all evidence is indexed by their time variables and plotted on a timeline. We believed that this way of visualizing the evidence allows the investigators to find coherent evidence faster and more intuitively. We have performed a user test where a group of people has evaluated our prototype tool against a modern commercial computer forensic tool and the results of this preliminary test are very promising. The results show that users completed the task in shorter time, with greater accuracy and with less errors using CyberForensic TimeLab. The subjects also experienced that the prototype were more intuitive to use and that it allowed them to easier locate evidence that was coherent in time.
The application consist of two different parts. The Scanner and the Viewer.
The Scanner is written in Perl and takes a list of evidence files which can be for exampled disk images or registry hives. The scanner will recursively scan the evidence files for time stamps and generate an XML file.
The Reader, written in C# will read the XML file generated by the scanner and display it graphically.