Högskolan i Skövde

In the evolving landscape of digital forensics, the ability to construct clear, accurate, and narratively coherent timeline reports from log data is essential for effective investigations and legal proceedings. However, existing tools often lack integrated support for viewing logs from multiple sources, annotating records, and generating structured reports. This thesis addresses this gap by developing and evaluating Kronolog, a lightweight, browser-based application designed to streamline the creation of narrated digital forensic timeline reports. Employing a Design Science Research (DSR) methodology, the study identifies key limitations in current tools through a comprehensive gap analysis of 77 existing solutions. Kronolog was developed to meet three core requirements: multi-source log viewing, annotation capabilities, and exportable report generation. The tool was evaluated through remote user testing and semi-structured interviews with ten participants. Results indicate high usability, with all participants successfully completing core tasks and expressing positive feedback on the tool’s interface, efficiency, and clarity. The study contributes a validated artifact that enhances forensic reporting workflows and offers practical insights into user-centered design for digital forensic tools. Future work includes expanding functionality, improving session persistence, and conducting evaluations with professional forensic practitioners.