Document Open Access Logo

A Formal Model for Forensically Sound Timestamp Normalization

Authors Lorenz Hornung , Carly Bakker, Bouke Timbermont, Roel van Dijk, Harm van Beek , Natasha Alechina

PDF

File

Thumbnail PDF
PDF
OASIcs.TIME.2026.10.pdf
  • Filesize: 0.74 MB
  • 21 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Applied computing → Evidence collection, storage and analysis
Keywords
  • Digital Forensics
  • Formal Model
  • Timestamp
  • Normalization

Metrics

Abstract

Digital forensic analysts interpret timestamps from digital systems to assess what happened in the past. Since these systems encode time according to different underlying domains, timestamps cannot be interpreted uniformly. To enable cross-system analysis, timestamps must therefore be normalized. In this paper, we propose a formal model for forensically sound timestamp normalization and examine its properties. We show that normalization generally does not guarantee the comparability of normalized timestamps. This means that the temporal order of digitally tracked events cannot always be determined. Furthermore, we illustrate that existing forensic tools do not adhere to the proposed normalization, resulting in violations of forensic soundness in the example discussed.

Cite As Get BibTex

Lorenz Hornung, Carly Bakker, Bouke Timbermont, Roel van Dijk, Harm van Beek, and Natasha Alechina. A Formal Model for Forensically Sound Timestamp Normalization. In 33rd International Symposium on Temporal Representation and Reasoning (TIME 2026). Open Access Series in Informatics (OASIcs), Volume 146, pp. 10:1-10:21, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/OASIcs.TIME.2026.10

Author Details

Lorenz Hornung
  • Open Universiteit, Heerlen, The Netherlands
Carly Bakker
  • Netherlands Forensic Institute, The Hague, The Netherlands
Bouke Timbermont
  • Open Universiteit, Heerlen, The Netherlands
  • Netherlands Forensic Institute, The Hague, The Netherlands
Roel van Dijk
  • Netherlands Forensic Institute, The Hague, The Netherlands
Harm van Beek
  • Open Universiteit, Heerlen, The Netherlands
  • Netherlands Forensic Institute, The Hague, The Netherlands
Natasha Alechina
  • Open Universiteit, Heerlen, The Netherlands
  • Utrecht University, The Netherlands

References

  1. James F. Allen. Maintaining knowledge about temporal intervals. Commun. ACM, 26(11):832-843, 1983. URL: https://doi.org/10.1145/182.358434.
  2. Eleftherios Anagnostopoulos, Sotiris Batsakis, and Euripides G.M. Petrakis. CHRONOS: A reasoning engine for qualitative temporal information in OWL. Procedia Computer Science, 22:70-77, 2013. URL: https://doi.org/10.1016/j.procs.2013.09.082.
  3. Apple. Apple file system reference. Accessed: March 4, 2026. URL: https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf.
  4. André Årnes, editor. Digital Forensics. Wiley, 1 edition, 2017. URL: https://doi.org/10.1002/9781119262442.
  5. Christel Baier and Joost-Pieter Katoen. Principles of model checking. The MIT Press, 2008. Google Scholar
  6. Claudio Bettini, Sushil Jajodia, and X. Sean Wang. Time Granularities in Databases, Data Mining, and Temporal Reasoning. Springer, Berlin, Heidelberg, 2000. URL: https://doi.org/10.1007/978-3-662-04228-1.
  7. Claudio Bettini, X. Sean Wang, and Sushil Jajodia. A general framework for time granularity and its application to temporal reasoning. Annals of Mathematics and Artificial Intelligence, 22(1-2):29-58, 1998. URL: https://doi.org/10.1023/A:1018938007511.
  8. Ceri Binding and Douglas Tudhope. Automatic normalization of temporal expressions. Journal of Computer applications in archaeology, 6:24-39, 2023. URL: https://doi.org/10.5334/jcaa.105.
  9. Frank Breitinger, Hudan Studiawan, and Chris Hargreaves. SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges. Forensic Science International: Digital Investigation, 53:301932, 2025. URL: https://doi.org/10.1016/j.fsidi.2025.301932.
  10. Brian Carrier. File system forensic analysis. Addison-Wesley Professional, 2005. Google Scholar
  11. Eoghan Casey. Digital evidence and computer crime: forensic science, computers and the Internet. Academic Press, 2011. Google Scholar
  12. Yoan Chabot, Aurélie Bertaux, Christophe Nicolle, and M-Tahar Kechadi. A complete formalized knowledge representation model for advanced digital forensics timeline analysis. Digital Investigation, 11:S95-S105, 2014. URL: https://doi.org/10.1016/j.diin.2014.05.009.
  13. Angel X. Chang and Christopher D. Manning. SUTime: A library for recognizing and normalizing time expressions. In Proceedings of the Eighth International Conference on Language Resources and Evaluation (LREC'12), pages 3735-3740. European Language Resources Association (ELRA), 2012. URL: https://nlp.stanford.edu/pubs/lrec2012-sutime.pdf.
  14. E. Ciapessoni, E. Corsetti, A. Montanari, and P. San Pietro. Embedding time granularity in a logical specification language for synchronous real-time systems. Science of Computer Programming, 20(1-2):141-171, 1993. URL: https://doi.org/10.1016/0167-6423(93)90025-K.
  15. James Clifford and Ahobala Rao. A Simple General Structure for Temporal Domains. Temporal Aspects of Information Systems, pages 17-28, 1988. Google Scholar
  16. Carlo Combi, Massimo Franceschet, and Adriano Peron. Representing and Reasoning about Temporal Granularities. Journal of Logic and Computation, 14(1):51-77, 2004. URL: https://doi.org/10.1093/logcom/14.1.51.
  17. Ana De Almeida Borges, Juan José Conejero Rodríguez, David Fernández-Duque, Mireia González Bedmar, and Joost J. Joosten. To drive or not to drive: A logical and computational analysis of European transport regulations. Information and Computation, 280:104636, 2021. URL: https://doi.org/10.1016/j.ic.2020.104636.
  18. Discord. API references. Accessed: March 4, 2026. URL: https://docs.discord.com/developers/reference.
  19. Lisa Marie Dreier, Céline Vanini, Christopher J. Hargreaves, Frank Breitinger, and Felix Freiling. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49:301755, 2024. URL: https://doi.org/10.1016/j.fsidi.2024.301755.
  20. Jérôme Euzenat and Angelo Montanari. Time Granularity. In Foundations of Artificial Intelligence, volume 1, pages 59-118. Elsevier, 2005. URL: https://doi.org/10.1016/S1574-6526(05)80005-7.
  21. Valentin Goranko and Antje Rumberg. Temporal Logic. In Edward N. Zalta and Uri Nodelman, editors, The Stanford Encyclopedia of Philosophy. Metaphysics Research Lab, Stanford University, Summer 2025 edition, 2025. Google Scholar
  22. The Open Group. Posix.1-2024. Accessed: March 4, 2026. URL: https://pubs.opengroup.org/onlinepubs/9799919799/.
  23. Kristinn Guðjónsson. Mastering the Super Timeline With log2timeline, 2010. URL: https://www.sans.org/white-papers/33438.
  24. International Organization for Standardization (ISO). ISO 8601: Date and time — Representations for information interchange — Part 1: Basic rules, 2019. Accessed: March 4, 2026. URL: https://www.iso.org/standard/70907.html.
  25. International Telecommunication Union (ITU). Recommendation ITU-R TF.460-6: Standard-frequency and time-signal emissions, 2002. Accessed: March 4, 2026. URL: https://www.itu.int/dms_pubrec/itu-r/rec/tf/R-REC-TF.460-6-200202-I!!PDF-E.pdf.
  26. M. Kaart and S. Laraghy. Android forensics: Interpretation of timestamps. Digital Investigation, 11(3):234-248, 2014. URL: https://doi.org/10.1016/j.diin.2014.05.001.
  27. Mohcine Madkour, Driss Benhaddou, and Cui Tao. Temporal data representation, normalization, extraction, and reasoning: A review from clinical domain. Computer Methods and Programs in Biomedicine, 128:52-68, 2016. URL: https://doi.org/10.1016/J.CMPB.2016.02.007.
  28. Joachim Metz. Pearls and pitfalls of timeline analysis, 2021. Accessed: March 4, 2026. URL: https://osdfir.blogspot.com/2021/10/pearls-and-pitfalls-of-timeline-analysis.html.
  29. Microsoft. exFAT file system specification. Accessed: March 4, 2026. URL: https://learn.microsoft.com/en-us/windows/win32/fileio/exfat-specification.
  30. Microsoft. File times. Accessed: March 4, 2026. URL: https://learn.microsoft.com/en-us/windows/win32/sysinfo/file-times.
  31. Angelo Montanari. Metric and Layered Temporal Logic for Time Granularity. PhD thesis, Universiteit van Amsterdam, 1996. URL: https://eprints.illc.uva.nl/id/eprint/1995/4/DS-1996-02.text.pdf.
  32. Christopher Neale. Fool me once: A systematic review of techniques to authenticate digital artefacts. Forensic Science International: Digital Investigation, 45:301516, 2023. URL: https://doi.org/10.1016/j.fsidi.2023.301516.
  33. Netherlands Forensic Institute. Hansken Digital Evidence Platform. Accessed: April 15, 2026. URL: https://www.hansken.nl/.
  34. Junghoon Oh, Sangjin Lee, and Hyunuk Hwang. Forensic Detection of Timestamp Manipulation for Digital Forensic Investigation. IEEE Access, 12:72544-72565, 2024. URL: https://doi.org/10.1109/ACCESS.2024.3395644.
  35. Log2Timeline Project. Plaso: Python Logfile Analysis and SuperTimeline Analysis. Accessed: April 15, 2026. URL: https://github.com/log2timeline/plaso.
  36. The Sleuth Kit Project. The Sleuth Kit. Accessed: April 15, 2026. URL: https://sleuthkit.org/sleuthkit/.
  37. Sriram Raghavan and Huzur Saran. UniTIME: Timestamp interpretation engine for developing unified timelines. In 2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE), pages 1-7. IEEE, 2013. URL: https://doi.org/10.1109/SADFE.2013.6911546.
  38. Bhupendra Singh and Gaurav Gupta. Analyzing Windows Subsystem for Linux Metadata to Detect Timestamp Forgery. In Gilbert Peterson and Sujeet Shenoi, editors, Advances in Digital Forensics XV, volume 569, pages 159-182. Springer International Publishing, 2019. URL: https://doi.org/10.1007/978-3-030-28752-8_9.
  39. Jannik Strötgen and Michael Gertz. Heideltime: High quality rule-based extraction and normalization of temporal expressions. In Proceedings of the 5th International Workshop on Semantic Evaluation, pages 321-324. Association for Computational Linguistics, 2010. URL: https://aclanthology.org/S10-1071/.
  40. Celine Taylor Parkins-Ozephius. Syntax error! Een verkenning van betrouwbaarheidsconcepten bij digitaal bewijs in strafzaken. Expertise & Recht, 2025(4), 2025. URL: https://www.uitgeverijparis.nl/nl/reader/2000000122/2000001179.
  41. H.M.A. van Beek, E.J. van Eijk, R.B. van Baar, M. Ugen, J.N.C. Bodde, and A.J. Siemelink. Digital forensics as a service: Game on. Digital Investigation, 15:20-38, 2015. URL: https://doi.org/10.1016/j.diin.2015.07.004.
  42. Johan van Benthem. The Logic of Time. Kluwer Academic Publishers, 2 edition, 1991. Google Scholar
  43. Céline Vanini, Christopher J. Hargreaves, Harm Van Beek, and Frank Breitinger. Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction. Forensic Science International: Digital Investigation, 49:301759, 2024. URL: https://doi.org/10.1016/j.fsidi.2024.301759.
  44. Svein Willassen. Hypothesis-Based Investigation of Digital Timestamps. In Indrajit Ray and Sujeet Shenoi, editors, Advances in Digital Forensics IV, volume 285, pages 75-86. Springer US, 2008. URL: https://doi.org/10.1007/978-0-387-84927-0_7.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact