{'fraction_non_alphanumeric': 0.026148969889064975, 'fraction_numerical': 0.0, 'mean_word_length': 4.663677130044843, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Towards event ordering in digital forensics

In criminal investigation and criminal justice, investigators are usually faced with several reports, which contain a set of events of interest. Often, it is important to be able to order these events so that relevant queries can be posed on this ordering, such as "was X at location Y when the murder took place?". However, ordering of these events is very difficult, especially if very few events are anchored in time, i.e., few events are associated with an explicit time. Manual extraction of all the events of interest from these reports is tedious. On the other hand, automated extraction is inaccurate at best, in the sense that either several events that may not be important could be included. This ultimately gives a large set of events to consider, and imposing an ordering on this set can yield a large tree structure, where nodes represent an event of interest, and an edge (i, j) indicates that event i occurred before or at the same time as event j, and the root node represents a special "start" event. In this paper, we investigate two techniques for automating extraction of events, and then ordering these. We compare the efficiency of the techniques through the size of the tree structure obtained