timeline reconstruction

Event reconstruction in digital forensics suffers from fragmented perspectives, inconsistent terminology, and methodological fragmentation, lacking a systematic, unifying framework. Method: This paper proposes the first unified temporal event reconstruction framework tailored for digital forensics—adapting classical forensic reconstruction models to the digital domain; constructing a comprehensive, lifecycle-spanning conceptual map of temporal reconstruction; and conducting a systematic literature review (SLR) coupled with conceptual modeling to clarify terminological relationships and process elements. Contribution/Results: The study identifies three core challenges—data scale, temporal distortion, and semantic ambiguity—and establishes an extensible classification system. It delivers a consensus-based terminology set and a standardized process paradigm, thereby providing a rigorous theoretical foundation for the development and evaluation of automated event reconstruction tools.

This study addresses the reliability degradation of event timelines in digital forensics due to user-initiated timestamp tampering on live systems. Conducting a qualitative user study with advanced students, we employ trace analysis, timestamp dependency modeling, and second-order trace resolution path induction to systematically uncover the “cognitive–technical” coupling barriers inherent in timestamp manipulation—a first-of-its-kind investigation. We propose a reliability assessment framework grounded in trace knowledge depth and modification feasibility, identifying core determinants of tampering success—including temporal trace recognition capability and kernel- or filesystem-level constraints. The framework provides empirically validated criteria for time-based evidentiary trustworthiness grading, enabling more accurate and robust forensic timeline reconstruction. Results demonstrate significant improvements in both precision and resilience of event reassembly under adversarial timestamp modification scenarios.

This work addresses the lack of traceable and tamper-resistant transparency mechanisms in large language models (LLMs) deployed in high-stakes decision-making contexts, which undermines accountability. To bridge this gap, the paper introduces the first LLM lifecycle auditing framework that integrates technical provenance with governance records. It proposes a reference architecture enabling cross-organizational traceability and implements a lightweight, open-source Python-based auditing layer. By leveraging append-only logs, event emitters, structured metadata, and an auditor interface, the system seamlessly integrates into existing LLM workflows with minimal intrusiveness. This design ensures complete, tamper-evident traceability across critical stages—including training, deployment, and monitoring—thereby facilitating robust accountability and responsibility attribution throughout the model’s lifecycle.

This study presents the first large-scale empirical analysis of Git history rewriting and its threats to software supply chain integrity and reproducibility. Addressing risks—including push conflicts, broken provenance, and malicious code injection—arising from history-altering operations (e.g., rebase, filter-branch) in public repositories, the authors analyze 111 million open-source projects archived by Software Heritage. Leveraging static analysis and two in-depth case studies, they propose the first evidence-driven taxonomy of Git history rewriting and develop GitHistorian, an automated detection tool. Applied at scale, the methodology identifies 1.22 million projects exhibiting history rewriting (8.7 million operations total), revealing prevalent legitimate use cases such as license updates and sensitive information removal. The work establishes a novel, scalable methodology for supply chain security assessment and delivers an open, extensible infrastructure for detecting and characterizing historical tampering.

Public sector actors increasingly rely on vendor-provided AI transparency documents, such as FactSheets, for accountability and risk assessment, yet their practical utility remains empirically unexamined. This study addresses this gap through semi-structured interviews and a systematic content analysis of FactSheets published by the GovAI Coalition, revealing for the first time that these documents function dually as both marketing instruments and disclosure mechanisms in practice. The findings indicate that while FactSheets alone are insufficient to support robust technical evaluation, they play a critical role in fostering trust, enabling stakeholder alignment, and sustaining ongoing governance dialogues. Building on these insights, the paper proposes reconceptualizing FactSheets not merely as static informational artifacts but as relational governance tools that facilitate dynamic, iterative engagement between public institutions and AI vendors.

Traditional Software Bill of Materials (SBOM) approaches struggle to accurately capture the components dynamically loaded at runtime in languages like Python, thereby limiting supply chain security and incident response capabilities. This work proposes MEM-SBOM, the first memory forensics–based framework for generating runtime SBOMs without requiring prior instrumentation. By analyzing the in-memory structures of the Python interpreter, bytecode, and package version metadata, MEM-SBOM directly reconstructs the true execution state from process memory. This approach overcomes the limitations of methods relying on static metadata or runtime monitoring, enabling both post-incident forensic analysis and deployment in production environments. Evaluated on 51 real-world Python applications, MEM-SBOM achieves 100% accuracy in component extraction, fully recovers runtime dependencies missed by existing tools, and precisely identifies vulnerable function calls.

This work addresses the lack of fine-grained evaluation benchmarks for large language models (LLMs) in generating software requirements specifications (SRS), particularly the absence of traceability among source requirements, intermediate artifacts, and generated outputs. The paper introduces the first framework to synthetically reconstruct pre-SRS artifacts with complete traceability chains from legacy SRS documents. By atomizing original SRS statements and leveraging multi-LLM voting for classification, constraint-guided prompting, and judge-guided iterative refinement, the approach produces high-fidelity intermediate artifacts. Experimental results demonstrate strong performance in both faithfulness (AlignScore 0.80–0.99) and downstream reconstructability (SBERT similarity 0.69–0.75), enabling fine-grained evaluation of SRS generation and revealing critical trade-offs among faithfulness, information retention, and artifact completeness.

Existing automated approaches for mapping cyber threat intelligence (CTI) to MITRE ATT&CK lack supporting evidence, provenance tracking, and validation history, making their credibility difficult to assess. This work proposes the first knowledge graph–driven framework for CTI governance that enables auditable management of TTP assertions through fine-grained evidence preservation, complete provenance chains, versioned trust decisions, and lossless revocation mechanisms. The framework integrates multi-extractor collaborative verification, assertion aggregation, consensus modeling, and policy-driven validation, all underpinned by versioned knowledge graph management. Evaluated on 65 CTI reports comprising 5,303 sentences, the approach achieves a precision of 90.6% under six-party consensus and efficiently supports seven categories of audit queries concerning provenance, trustworthiness, and versioning.

Modern OLTP systems often suffer from frequent schema changes, missing primary/foreign keys, and fragmented execution traces, rendering traditional approaches—reliant on fixed schemas and manual modeling—costly and error-prone. This work proposes a fully automated pipeline that operates without predefined schemas by identifying quasi-key and timestamp columns, discovering inter-table relationships through statistical signals, and assembling and ordering events accordingly. To capture long-range dependencies across system events, the method incorporates a Temporal Convolutional Network (TCN). By eliminating dependence on ER diagrams, domain-specific templates, and stable schemas, the approach enables generalizable and scalable reconstruction of execution traces in dynamic information systems. Experimental results on TPC-H/E, synthetic, and real-world industrial datasets demonstrate 85% accuracy in event prediction and recovery of approximately 82% of true predecessor relationships, yielding high-fidelity process traces.

This study addresses the longstanding disconnect between detection engineering and digital forensics, which has led to a gap between real-time alerts and post-incident analysis. To bridge this divide, the authors propose a unified detection-and-forensics methodology based on Velociraptor that triggers targeted evidence collection immediately upon detection events, thereby integrating monitoring and forensic workflows. The approach introduces an innovative four-stage framework that transforms forensic artifacts into reusable, testable detection rules, enabling efficient initial triage without requiring full disk imaging. By leveraging BaseVQL data sources—such as Prefetch, USN Journal, and WMI—it facilitates cross-artifact correlation and periodic analysis, allowing effective screening even in the absence of Windows Event Logs. This significantly reduces data acquisition volume while supporting continuous monitoring.