Rule-based Entity Recognition for Forensic Timeline

Abstract

In digital forensics, the sequence of all events in a forensic image needs to be analyzed. Building a forensic timeline is one of the possible techniques. Naturally, the forensic timeline contains several standard entities, such as date, time, and host name. Another field provided by a forensic timeline is a message, which is a brief description of an event. To assist investigators in analyzing the incident, a more detailed identification of the entity name is needed from the message text. In this paper, rule-based entity recognition is proposed. We also discuss the advantages and disadvantages of this technique. Experimental results show that the entities in the message column have been annotated successfully.