Digital Forensics File Timeline Calculator

Analyze file system activity patterns to detect anomalies. Calculates activity rate, deletion ratio, and an anomaly score indicating potential anti-forensic behavior.

Inputs

Files Analyzed

Time Range

hrs

Suspicious Files

Deleted Files

Tab to move between fields

Results

Anomaly Score

41 / 100

Risk Level

Medium Risk — Suspicious Activity

File Activity Rate208.33 files/hr

Deletion Ratio4%

How to Use This Calculator

Enter Files Analyzed, Time Range, and Suspicious Files.
Set Deleted Files.
Review Anomaly Score (/ 100) and Risk Level.
Use File Activity Rate (files/hr) and Deletion Ratio (%) to inform your decision.
Use the chart to visualize the results and explore different scenarios by adjusting inputs.

How the result changes with Files Analyzed

Files Analyzed	Anomaly Score	Risk Level
100,001	31 / 100	Low Risk — Normal Activity
350,001	30 / 100	Low Risk — Normal Activity
650,000	30 / 100	Low Risk — Normal Activity
900,000	30 / 100	Low Risk — Normal Activity

What each input means

Files Analyzed: Total number of files examined in the forensic image.
Time Range: Time window of activity being analyzed.
Suspicious Files: Files with anomalous timestamps, hidden attributes, or known tool signatures.
Deleted Files: Number of deleted or wiped files recovered from unallocated space.

What each result means

File Activity Rate: Average files created/modified/deleted per hour.
Deletion Ratio: Percentage of analyzed files that were deleted.
Anomaly Score: Composite score indicating likelihood of intentional evidence destruction.
Risk Level: Classification based on anomaly score thresholds.

How this is calculated

Worked example, using the default values

Identify Input Parameters
4 parameters
Files Analyzed = 5000, Time Range = 24, Suspicious Files = 50, Deleted Files = 200 = 4 input(s) provided
Calculate Anomaly Score
Anomaly Score
41 = 41
Calculate File Activity Rate
File Activity Rate
208.33 = 208.33
Calculate Deletion Ratio
Deletion Ratio
4 = 4