computer forensics, computer forensics expert, mobile phone forensics, expert witness

Inside Out

tool – pasco2

I am off to the DFRWS 2006 conference in a week or so to present my paper "A correlation method for establishing provenance of timestamps in digital evidence". In this paper I describe some research I have performed in characterising where the behaviour of computer clocks differs from the ideal.

A second theme of the paper is the identification of methods of correlating commonly found evidence to establish provenance of timestamps. In this case, I have been correlating Internet Explorer Cache and History files with Squid cache logs.

As a part of my work I reimplemented and extended a parsing tool for the IE cache and history index.dat files. This was due to finding bugs in the initial pasco tool (which was missing some error conditions from the read() system call). That and I am more productive using java.

The tool, which I have named pasco2 in honour of Keith Jones' earlier IE parser, pasco , can be found here: pasco2.