This site is for material from my formal research work. I have some miscellaneous other stuff on my personal site.

An HTML list of Publications is at the end of this page, and a BiBTex file is available which includes all of the publications and the work below.

-- Dylan Leigh
Last Updated 17 January 2015

ZFS Timeline Forensics

Honours Thesis

My Honours(Computer Science) studies at Victoria University, supervised by AProf. Hao Shi.

BSDCan 2014 Presentation

This is from the main part of my honours research. "Forensic Timestamp Analysis of ZFS" was presented 14 May 2014 at BSDCan, University of Ottowa, Canada.

ZFS ZDB Plaso Parsers

[click here to go to the parser page]

NOTE: Source code for the ZFS/ZDB Parsers is now hosted on GitHub

This is a practical implementation of the above research; new parsers for the Plaso super-timeline software to generate events from internal ZFS objects and metadata.

My article "Adding ZFS Events to a Super-Timeline" on the development and use of these parsers was published in Digital Forensics Magazine, Issue 20, August 2014.

Publication List

Also available in BiBTex form.

Dylan Leigh, Forensic Timeline Analysis of the Zettabyte File System. Honours thesis, College of Engineering and Science, Victoria University, January 2015.
Dylan Leigh and Hao Shi, Adding ZFS Events to a Super-timeline. Digital Forensics Magazine, (20), August 2014.
Dylan Leigh and Hao Shi, Forensic Timestamp Analysis of ZFS. In BSDCan 2014. BSDCan, May 2014.
Dylan Leigh, ZFS Timeline Forensics Quick Reference, May 2014.