Digital provenance - interpretation, verification and corroboration

This paper defines the attributes that are required to provide 'good' provenance. The various sources that may be used to verify the provenance of digital information during the investigation of a Microsoft® Windows® based computer system are presented. This paper shows how provenance can be corroborated by artefacts which indicate how a computer system was connected to the outside world and the capabilities that it provided to a user. Finally consideration is given to a number of commonly used forensic tools and shows how they represent the provenance of information to an investigator.