Event Reconstruction

Event reconstruction is one of the most important step in digital forensic investigations. It allows investigators to have a clear view of the events that have occurred over time. Event reconstruction is a complex task which requires exploration of a large amount of events due to the pervasiveness of new technologies nowadays. Any evidence produced at the end of the investigative process must also meet the requirements of the courts, such as reproducibility, verifiability, validation, etc. After defining the most important concepts of event reconstruction, a survey of the challenges of this field and solutions proposed so far is given in this chapter. Irish Research Council Science Foundation Ireland National Natural Science Foundation of China Science Foundation of Education Commission of Beijing CAEP THz Science and Technology Foundation Young Talent Project of Beijing University of Technology Special Matching Project of Local Supported by Centre Graduate Science and Technology Fund of Beijing University of Technology Iraqi Ministry of Higher Education and Scientific Research National Development Plan (NDP)