Event reconstruction is an important phase in digital forensic investigation, which determines what happened during the incident. The digital investigator uses the findings of this phase to prepare reports for the court. Since the results must be reproducible and verifiable, it is necessary that the event reconstruction methods be rigorous and strict. In order to fulfill the legal requirements, this study proposes an event reconstruction framework which is based on the formal mathematical methods. In particular, it uses the temporal logic model checking that is an automatic verification technique. The idea is that the system under investigation is modeled as a transition system. Then the digital forensic property is specified using the modal μ-calculus. Finally, a model checking algorithm verifies whether the transition system meets the property. In order to demonstrate the proposed formal event reconstruction framework, an abstract model of the FAT file system is presented and some digital forensic properties are formulated. A big problem in model checking is the so-called state space explosion. This study addresses this problem and suggests some solutions to it. Finally, the proposed framework is applied to a case study to demonstrate how some hypotheses can be proved or refuted.

事件重建是数字取证调查中的一个重要阶段，它决定了事件发生的过程。数字调查员使用此阶段的结果为法院准备报告。由于结果必须是可复制和可验证的，因此事件重建方法必须严格且严格。为了满足法律要求，本研究提出了一种基于形式化数学方法的事件重建框架。特别是，它使用作为自动验证技术的时间逻辑模型检查。这个想法是将要研究的系统建模为过渡系统。然后，使用模态微积分指定数字取证属性。最后，模型检查算法验证过渡系统是否满足该属性。为了证明所提出的正式事件重建框架，提出了FAT文件系统的抽象模型，并阐述了一些数字取证属性。模型检查中的一个大问题是所谓的状态空间爆炸。这项研究解决了这个问题并提出了一些解决方案。最后，将提出的框架应用于案例研究，以说明如何证明或驳斥某些假设。