Chabot, YoanYoanChabotBertaux, AurélieAurélieBertauxNicolle, ChristopheChristopheNicolleKechadi, TaharTaharKechadi2015-02-232015-02-232014 IEEE2014-09http://hdl.handle.net/10197/6394IEEE Joint Intelligence and Security Informatics Conference (ISI-EISIC 2014), 24-26 September, the Hague, NetherlandsTo determine the circumstances of an incident, investigators need to reconstruct events that occurred in the past. The large amount of data spread across the crime scene makes this task very tedious and complex. In particular, the analysis of the reconstructed timeline, due to the huge quantity of events that occurred on a digital system, is almost impossible and leads to cognitive overload. Therefore, it becomes more and more necessary to develop automatic tools to help or even replace investigators in some parts of the investigation. This paper introduces a multi-layered architecture designed to assist the investigative team in the extraction of information left in the crime scene, the construction of the timeline representing the incident and the interpretation of this latter.en© 2014 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other worksMachine learningStatisticsConference Publication10.1109/JISIC.2014.542015-02-17https://creativecommons.org/licenses/by-nc-nd/3.0/ie/