State Machine Theory of Digital Forensic Analysis

Software

Event Reconstruction and Analysis in Lisp (EARL) is my experimental software for finite state machine analysis of digital evidence.

Presentations

1. P. Gladyshev "State Machine Theory of Digital Investigations" - a very accessible introduction to the key ideas of the theory without heavy maths.

Articles and Reports

1. P. Gladyshev, A. Enbacka "Rigorous Development of Automated Inconsistency Checks for Digital Evidence Using the B Method", International Journal of Digital Evidence, vol. 6, no. 2., November 2007.
2. P. Gladyshev, A. Patel "Formalising Event Time Bounding in Digital Investigations", International Journal of Digital Evidence, vol. 4, no. 2., December 2005.
   • Event time bounding is a well known technique that allows the investigator to determine temporal boundaries of a particular event using known times of other events, which are causally connected to the event of interest. This paper presents mathematical analysis of this technique, and an algorithm for its automation.
     
3. P. Gladyshev, "Adding Real Time into State Machine Analysis of Digital Evidence", unpublished manuscript, June 2005. 
   • This paper presents mathematical foundations of the temporal reasoning algorithm that will be included into Earl v 0.2.
   
   
4. P. Gladyshev, "Finite State Machine Analysis of a Blackmail Investigation", International Journal of Digital Evidence, vol. 4, no. 1., May 2005.
   • This paper is an informal introduction into state machine analysis of digital evidence illustrated on a real-world example (the example is included into distribution of Earl).
   
   
5. P. Gladyshev, "Formalising Event Reconstruction in Digital Investigations", Ph.D. dissertation, Department of Computer Science, University College Dublin, August 2004.
   • A book-length, in-depth discussion of event reconstruction in digital investgiations.
   
   
6. P. Gladyshev, A. Patel, "Finite State Machine Approach to Digital Event Reconstruction", Digital Investigation journal, vol.1, no. 2, Elsevier, May 2004. A draft of the paper is available here.
   • A concise summary of the Ph.D. dissertation. Gives a formal mathematical definition of the event reconstrcution problem in digital investigations and presents an event reconstruction algorithm for solving it.

My previous publications can be found here.


Pavel Gladyshev, Ph.D., M.Sc., Dip.Eng.

School of Computer Science and Informatics,
University College Dublin
Belfield, Dublin 4, Ireland
email: pavel dot gladyshev at ucd dot ie