hline

\end{tabular}
\caption{``Benign'' File Information}
\label{tab:file_list}
\end{table}

The ``pertinent'' actions included emulated user activities for each of the three sample case scenarios (described in Section~\ref{subsec:case}). The actions defined as pertinent are those surrounding the activities with each scenario. For example, those associated with downloading CSEM (downloading research paper on the topic, picture download and photos sent/received using online chat tools); the execution of a hacking python script for cracking user's password; and creating fake invoices for a financial fraud investigation. The files related to these actions are labelled as ``pertinent''.

\begin{table}[!ht]
\centering
\begin{tabular}{c|c|c}
\hline
\textbf{File Type}& \textbf{User Actions} & \textbf{Number}  \\ \hline
txt & creation, access, edit & 6 \\ \hline
py & creation, unzip, access, move, copy & 6 \\ \hline
jpg & creation, access & 13 \\ \hline
png & creation (download from web), access & 4 \\ \hline
gif & creation (download from web), access & 1 \\ \hline
pdf & creation (download from web) & 1 \\ \hline

\end{tabular}
\caption{``Illegal'' File Information}
\label{tab:file_list}
\end{table}

\begin{figure}[!h]
    \includegraphics[width=0.5\textwidth]{images/data_generation_2.pdf}
    \caption{Data Set Generation Process}
    \label{fig:generation}
\end{figure}

Subsequently, the files' timelines were extracted. The process for this is shown in Figure~\ref{fig:generation}. The virtual machine's (VM's) virtual hard disk (VHD) images were converted to raw format and had their associated timelines extracted using \textit{Plaso}. This timeline consists digital events associated with all of the file artefacts on the disk image. This is filtered for each file artefact to create the individual file artefact timelines. High frequency words and sources and the types of digital events are used as features for model training.



\subsection{Example Scenarios}
\label{subsec:case}
To demonstrate the viability of the approach outlined in this paper, three sample scenarios are used (and will be referenced below):

\begin{enumerate}
    \item Possession of CSEM Investigation\\
            \textit{The suspect uses computer access chat room online related to child sexual exploitation material (CSEM). Videos and pictures are downloaded to local disk from installed browser. A computer belonging to a suspect was sized during a CSEM case investigation. Investigators use the known hash database filtering out the known illegal files; then a data reduction tool gets a set of user files that is most common to find pertinent files. These are chat log files, email files and picture files. With these picture files, some are detected as illegal from a known hash database. The investigator puts these file into a SVM model for training. In the end, other unknown files was put into the model, files are sorted by relevancy score for further analysis.}
    \item Hacking Case Investigation\\
            \textit{A computer was seized during a hacking case investigation. The suspect uses an email account. Keyword searching for ``username'' and ``password'' identifies several files. These are text files with content related to the use of password cracking scripts and scripts for hacking wireless networks. Then investigators choose to put these files into a model to look for other relevant files.}
    \item Financial Fraud Investigation\\
            \textit{The suspect creates a phishing site to con victims into supplying their email address and password and other personal information. The suspect uses their accounts to conduct fraud online. During an investigation of a financial fraud case, investigators are looking to find out potentially fraudulent financial instruments, invoices or other financial records. Searching the keyword ``invoice(s)'' in \texttt{pdf} and \texttt{doc} files from the raw disk image results in the discovery of some relevant files. Then investigators use the analysis result to build model to recognise similar files.}
\end{enumerate}


\section{Results}
\label{results}

The experimentation for proving the viability of the proposed approach uses the analysis of the disk image. In this Section, 1) the disk timeline acquired is presented showing the source of the the file timelines and what information is contained in a full disk image timeline; 2) the technique for generating these file timelines from the full disk timeline is presented showing the user action information; 3) the case investigation process result is presented. 

\subsection{Disk Image Timeline Analysis}

This Section presents an overview of timeline generation. The full disk timeline reflects the usage of the seized machine, the number of digital events discovered in total, the number of files, the count of each digital events type, etc. \textit{psteal} is a tool in \textit{Plaso} for comprehensive disk image timeline generation and the command used is:

\texttt{psteal.py --source disk\_image\_name.dd -t l2tcsv -w timeline\_name.csv --partitions all}

From the generated timeline, basic information about the created disk image can be retrieved; in this scenario:

- Number of Events: 3,120,364

- Number of Files: 307,971

The timeline consists of all level of digital events. \textit{pandas} is used to further analyse the timeline. To acquire counts of unique values the method \texttt{count\_values()} is used. On a full disk image level, the source of digital events reveals information of the usage of device:

\begin{table}[!h]
\small
\centering
\begin{tabular}{|c|c|c|c|}
\hline
\textbf{Event Type} & \textbf{Count} & \textbf{Event Type} & \textbf{Count} \\ \hline
Last Connection Time & 3 & Last Login Time & 2 \\ \hline
Scheduled to start & 3 & Last Shutdown Time & 1 \\ \hline
Last Password Reset & 3 & Last Used Time & 1 \\ \hline
Installation Time & 2 & - & - \\ \hline
\end{tabular}
\caption{Device Related Event}
\label{device_event}
\end{table}

Digital events are related to file-system metadata information. In this scenario, the following were extracted:
\begin{table}[!h]
\small
\centering
\begin{tabular}{|c|c|}
\hline
\textbf{Event Type} & \textbf{Count} \\ \hline
Content Modification Time & 962,293 \\ \hline
Metadata Modification Time & 551,502 \\ \hline
\begin{tabular}[c]{@{}c@{}}Creation Time; Last Access Time; \\ Metadata Modification Time\end{tabular} & 343,906 \\ \hline
\begin{tabular}[c]{@{}c@{}}Content Modification Time; Creation Time; \\ Last Access Time; Metadata Modification Time\end{tabular} & 302,467 \\ \hline
Last Access Time & 283,980 \\ \hline
Creation Time & 235,871 \\ \hline
Content Modification Time; Creation Time & 212,687 \\ \hline
Creation Time; Last Access Time & 45,898 \\ \hline
\begin{tabular}[c]{@{}c@{}}Content Modification Time; Last Access Time; \\ Metadata Modification Time\end{tabular} & 35,818 \\ \hline
Last Access Time; Metadata Modification Time & 32,881 \\ \hline
\end{tabular}
\caption{File Artefacts Event - Common}
\label{file_events_common}
\end{table}

There are some types of events that can only occur to a specific type of file. For example, Previous Last Time Executed could happen by a executable file, but not document or image file. Another example is a File Downloaded event -- this can only occur if a file is from a request to another machine through a network connection. These special events can be used as features pertaining to associated file artefacts, i.e., \textit{true} or \textit{false} as the feature value.

\begin{table}[!h]
\centering
\begin{tabular}{|c|c|}
\hline
\textbf{Event Type} & \textbf{Count} \\ \hline
Last Visited Time & 5,534 \\ \hline
Previous Last Time Executed & 1,107 \\ \hline
File Last Modification Time & 585 \\ \hline
Start Time & 410 \\ \hline
Last Time Executed & 401 \\ \hline
File Downloaded & 118 \\ \hline
Document Creation Time & 86 \\ \hline 
First Connection Time & 85 \\ \hline 
Document Last Save Time & 82 \\ \hline 
Content Deletion Time & 58 \\ \hline 
\end{tabular}
\caption{File Artefacts Event - Specific}
\label{file_events_specific}
\end{table}

    


\subsection{File Artefact Timeline Analysis}
