Event Reconstruction From Forensic Timeline with Formal Event Modeling

Digital forensic investigations require structured methods to analyze heterogeneous system logs and reconstruct accurate timelines of user activities. This study presents a lightweight formal model for the reconstruction of digital forensic events using extraction, mapping, and analysis operators. The method transforms heterogeneous web and system logs into unified entities, relations, and a filtered event timeline. The method applies temporal correlation to distinguish meaningful user actions from automated background processes. It reveals clear behavioral phases such as browser activities, software installation, PowerShell execution, and system shutdown. Experiments with multiple forensic case studies show that the model consistently isolates high-relevance events, with low fitness and generalization scores that indicate its deliberate focus on evidence-driven reconstruction.