A Comprehensive Review of Graph-Based Forensic Timeline Reconstruction: Analysis of the Timelance Framework

Abstract

The increasing volume of digital evidence and complexity of cyber incidents have exposed the shortcomings of the current forensic timeline reconstruction systems. While timeline methods can be suitable for simple ordering, they cannot preserve the semantic relationships between the unrelated forensic evidence and the causal links. This review paper will discuss the transition digital forensics took from manual analysis to intelligent graph-based reasoning systems, particularly with regard to the Timelance framework – an offline forensic solution which combines event normalization, behavioral analysis,and knowledge graph modeling. This review, through the analysis of the current state of the art in comparison and deconstruction of the architectural enhancements of Timelance will help nameresearch gaps as well as trade-offs in performance to inform the design ofnext-generation forensic analysis tools for air-gapped environments.