Digital Forensics File Timeline Calculator

The deletion score can contribute up to 40 points, scaling as deletionRatio times 2 and capped there; the suspicious-files score can contribute up to 30 points, scaling as the suspicious-to-total ratio times 300 and capped; and the activity score can contribute up to 30 points, scaling with file activity rate and maxing out once the rate reaches 100 files per hour. The three are simply summed for the final 0-100 anomaly score, so deletion activity carries the heaviest single weight of the three factors.

The calculator computes deletionRatio as deleted files divided by files analyzed (times 100), so it's expressed as a percentage of the total dataset rather than a raw count. This makes the metric comparable across investigations of very different scale — 200 deleted files out of 5,000 analyzed (4%) reads very differently than 200 deleted files out of 500 analyzed (40%), even though the raw deletion count is identical.

The activity score is capped at 30 points and reaches that maximum once fileActivityRate (files analyzed divided by the time range in hours) exceeds 100 files per hour; below that threshold it scales proportionally. The underlying assumption baked into the code is that legitimate day-to-day computer use rarely generates that much sustained file churn, so a rate above 100/hr is treated as maximally suspicious regardless of how much higher it climbs.

No. The score is a heuristic composite built from three statistical ratios with fixed weights and thresholds chosen as reasonable defaults, not derived from any specific forensic standard or validated dataset. A score of 70+ flags that the file-system statistics look unusual and warrants closer manual review — MFT parsing, $LogFile review, shadow copy comparison — but it is not, by itself, proof that evidence was deliberately destroyed.