Timely
Digital forensics data visualization tool
Overview
Timely is an undergraduate research project: a chain-of-custody visualizer for digital forensics workflows. The work combined domain research, data modeling, and implementation, and was later published at IEEE SoutheastCon 2019.
What was built
A chain-of-custody visualization system for digital forensic workflows.
Key constraints
Complex relationship data, domain-specific correctness, and research-grade rigor.
Outcome signal
Published at IEEE SoutheastCon 2019 after peer-review and iterative validation.
Technical artifacts and implementation status
Technical artifacts
Publicly shareable artifacts
Research artifacts with limited public access
- The original undergraduate repository and datasets are archived and not fully public.
- Normally shared artifacts would include dataset samples, graph interaction recordings, and benchmark runs used during publication prep.
Implemented
- Graph-based chain-of-custody visualizer
- Interactive node and edge navigation
- Research write-up and publication support
In development
- Project is complete and archived
- No active feature development
Planned
- No current roadmap items
- Potential modernization only if reopened
Model diagram
Evidence node
Artifact, source, handler metadata
Relationship edges
Transfer, analysis, derivation links
Investigator view
Timeline and lineage exploration
Decision log
| Problem | Options considered | Chosen solution | Rejected alternatives | Why this won | Accepted tradeoffs | Result after implementation |
|---|---|---|---|---|---|---|
| Linear tables obscured evidence lineage relationships. | Tabular views, timeline-only views, or graph model. | Interactive graph visualization. | Spreadsheet-style and static timeline-only interfaces. | Made dependency and transfer paths easier to inspect quickly. | Higher UI complexity and rendering constraints. | Investigators could inspect relationship context faster than with linear views. |
| Need broad accessibility for researchers and reviewers. | Desktop-only app or web-delivered prototype. | Web stack delivery. | Desktop-bound prototype requiring local installs. | Simplified distribution and evaluation in research settings. | Browser performance limits for dense graphs. | Lower friction for demonstration, collaboration, and publication review. |
| Forensic domain requirements were easy to misinterpret without expert input. | Build from assumptions or iterate with domain feedback. | Iterative cycles with forensic feedback. | One-pass implementation based only on literature. | Increased fidelity to real analyst workflows. | Longer early design and validation cycles. | More credible problem framing and stronger publication readiness. |
The Research Problem
Context: Digital Forensics
Digital forensics is the discipline of extracting and analyzing digital evidence from computer systems. A critical component is chain of custody, maintaining a documented history of how evidence was collected, transferred, analyzed, and preserved. This history is essential for legal proceedings; any break in the chain undermines the evidence.
The Problem
Chain of custody data is highly interconnected. Investigators need to answer:
- Which evidence items were collected when and where
- Who handled each item (and when)
- What analyses were performed
- How results from different analyses relate to each other
- The complete lineage of derivative artifacts
Traditional tables and sequential logs hide relationship context, which is often the core of forensic reasoning.
Research Question
How can we effectively visualize chain of custody data to help forensic investigators quickly understand the relationships, history, and integrity of digital evidence?
Solution: Interactive Graph Visualization
Design Approach
Rather than tables or timelines, we designed Timely as an interactive graph visualization. Chain of custody data naturally fits a graph model:
Nodes: Evidence Entities
Each piece of evidence, analysis, or derivative artifact is a node. Properties include type, timestamp, handler, and other metadata.
Edges: Relationships
Relationships between entities (evidence → analysis, analysis → derivative artifact, evidence → handler) become edges. Edges are typed and directed, showing causality and relationships.
Visualization: Interactive Exploration
Users can navigate the graph, zoom, pan, and query relationships. Color coding shows entity types. Size and positioning represent temporal relationships.
Technology Choices
The implementation used web technologies for accessibility and cross-platform compatibility:
- Vis.js: Powerful JavaScript graph visualization library with interactive features
- HTML5 & Canvas: Smooth rendering and performance for complex graphs
- Bootstrap: UI framework for forms, controls, and responsive layout
- Git: Version control for research collaboration and tracking iterations
Research Methodology
Literature Review
We conducted a comprehensive review of existing visualization techniques for complex systems, graph visualization approaches, and forensic methodology literature. This groundwork ensured our approach was novel and built on established principles.
Design & Development Cycles
The project iterated through prototype, domain review, and refinement cycles, with each iteration validated by forensic professionals.
Key Research Contributions
1. Novel Visualization Approach
Demonstrated that graph visualization is more effective than traditional tabular or sequential representations for chain of custody data. Users could understand complex relationships faster.
2. Domain-Specific Design
Showed how general visualization techniques can be adapted for specific domains by understanding user workflows, constraints, and information needs. Generic visualization ≠ effective domain visualization.
3. Practical Implementation
Proved the concept works in practice with real forensic datasets. Showed that the approach scales reasonably well even with complex chains of custody involving hundreds of evidence items.
Publication & Impact
Peer-Reviewed Publication
The research was published at IEEE SoutheastCon 2019 under the title "Timely: A Chain of Custody Data Visualizer." This was a selective conference requiring peer review and rigorous evaluation.
Publishing in a peer-reviewed venue meant:
- Subjecting the work to expert review and critique
- Responding to reviewers with rigorous counterarguments or improvements
- Demonstrating that the research contributes novel insights to the field
- Creating a permanent record of the work in academic literature
What This Demonstrates
Publishing research as an undergraduate shows the ability to conduct rigorous, original work that contributes to a field. It is different from industry projects, because it requires deep thinking about problems, literature knowledge, and the discipline to document and communicate findings formally.
Technical & Research Skills Demonstrated
Information Visualization
Designing effective visual representations of complex data. Understanding how humans perceive and interpret visualizations. Choosing appropriate visualization techniques for specific data types and use cases.
Domain Understanding
Learning a specialized domain (digital forensics) sufficiently to identify real problems and design solutions. This required reading forensic methodology papers, understanding investigator workflows, and consulting with experts.
System Design
Designing a system that could represent and visualize complex chain of custody data. This included data model design, graph algorithms, and interaction design.
Research Discipline
Conducting research systematically: literature review, problem definition, solution design, evaluation, and documentation. Publishing at a peer-reviewed venue requires rigor and communication skills.
Technical Implementation
Building a working prototype that could handle real forensic datasets. Choosing appropriate tools and libraries. Understanding performance and scalability implications.
What This Project Taught Me
1. Understanding Domain Before Building
Building for a specific domain requires deep understanding of how users work, what matters to them, and what constraints they face. Reading papers is not enough, talking to domain experts and understanding workflows is essential.
2. The Power of Visualization
Visualization decisions directly affect analysis quality. In this project, graph navigation exposed relationships that were difficult to track in tables. That lesson carried into later product work: representation choices are engineering choices.
3. Research Communication Skills
Writing and publishing research taught me to think clearly, structure complex ideas logically, and communicate findings to skeptical audiences. These skills are valuable far beyond academia, they are essential for technical leadership, architecture documentation, and knowledge sharing.
4. Building for Real Use Cases
The best validation for research work is actual use by domain experts. Iterating based on feedback from forensic professionals revealed issues that theoretical analysis would have missed.
Why This Matters on a Portfolio
Timely represents different aspects of engineering maturity than typical software projects:
Research Thinking: Shows the ability to identify novel problems, conduct literature review, and contribute original solutions. Not all engineering is about shipping products, sometimes it is about understanding problem domains deeply.
Rigor: Academic publication requires a level of rigor, including peer review, reproducibility, and formal documentation.
Communication: Publishing a paper means explaining complex ideas clearly to experts in the field. This is valuable for technical leadership roles.
Technical Depth: While an undergraduate project, it demonstrates the ability to go deep into a specialized domain and build sophisticated solutions. This is rare for undergraduates.