2026-10-10T21:17:37Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:27706 2026-10-10T19:48:19Z ddc:004 open_access

A Formal Model for Forensically Sound Timestamp Normalization Hornung, Lorenz Bakker, Carly Timbermont, Bouke van Dijk, Roel van Beek, Harm Alechina, Natasha Digital Forensics Formal Model Timestamp Normalization Digital forensic analysts interpret timestamps from digital systems to assess what happened in the past. Since these systems encode time according to different underlying domains, timestamps cannot be interpreted uniformly. To enable cross-system analysis, timestamps must therefore be normalized. In this paper, we propose a formal model for forensically sound timestamp normalization and examine its properties. We show that normalization generally does not guarantee the comparability of normalized timestamps. This means that the temporal order of digitally tracked events cannot always be determined. Furthermore, we illustrate that existing forensic tools do not adhere to the proposed normalization, resulting in violations of forensic soundness in the example discussed. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Lorenz Hornung and Carly Bakker and Bouke Timbermont and Roel van Dijk and Harm van Beek and Natasha Alechina 2026 Is Part Of OASIcs, Volume 146, 33rd International Symposium on Temporal Representation and Reasoning (TIME 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/OASIcs.TIME.2026.10 urn:nbn:de:0030-drops-277061 https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.TIME.2026.10 eng https://creativecommons.org/licenses/by/4.0/legalcode