Formalising Event Time Bounding in Digital Investigations

A timestamp is a clock reading attached to a unit of data. Timestamps are widely used in computing and seem to offer an easy way to determine the time of events in digital investigations. Unfortunately, the ability of users to change clock settings reduces the evidential weight of timestamps. Alternative methods of estimating times of events are often needed to corroborate timestamps. One such method is to “sandwich ” the unknown time of an event between known times of causally connected events. For example, if event A caused event B and event B caused event C, then the time of B must be between the times of A and C. This type of reasoning is sometimes called “event time bounding.” This paper defines event time bounding as a mathematical problem and presents an algorithm for solving it 1. The determination of event times is an important and difficult task in digital forensics as demonstrated by the following example, which was originally described in Bates (1997): A managing director of some company, Mr. C was blackmailed. During th