提出统一的时间线事件重建框架，解决数字取证碎片化问题。
SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges
- 基于传统法医模型构建时间线重建统一框架。
- 系统梳理文献，归纳核心挑战与研究空白。
- 适合数字取证研究者与司法鉴定人员参考。
事件重建是数字取证中通过分析数字痕迹推断过去活动的技术。尽管意义重大，该领域研究分散，多数工作仅聚焦于时间线生成或篡改检测等单一环节。本文提出一个基于传统法医科学模型的综合性时间线事件重建框架，旨在填补这一空白。首先，统一现有术语并构建清晰的关系图谱，阐明重建过程中的关键要素。通过全面文献调研，对主要挑战进行分类与整理，拓展讨论范围，超越数据量等常见问题。最后，总结近期进展，并提出未来研究方向，明确具体研究缺口。本工作为数字取证提供了结构化方法、关键发现与更深入的挑战理解，旨在夯实该领域的理论基础。
原文摘要 · Abstract (English)
Event reconstruction is a technique that examiners can use to attempt to infer past activities by analyzing digital artifacts. Despite its significance, the field suffers from fragmented research, with studies often focusing narrowly on aspects like timeline creation or tampering detection. This paper addresses the lack of a unified perspective by proposing a comprehensive framework for timeline-based event reconstruction, adapted from traditional forensic science models. We begin by harmonizing existing terminology and presenting a cohesive diagram that clarifies the relationships between key elements of the reconstruction process. Through a comprehensive literature survey, we classify and organize the main challenges, extending the discussion beyond common issues like data volume. Lastly, we highlight recent advancements and propose directions for future research, including specific research gaps. By providing a structured approach, key findings, and a clearer understanding of the underlying challenges, this work aims to strengthen the foundation of digital forensics.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。