For the digital forensic examiner, being able to perceive change-over-time supports the goal of being able to explain "what happened." In our thesis, we focus on the improvements brought to digital forensic analysis by the visualization of forensic data and its application to digital forensic data that records change-over-time, specifically for a directory-tree structure and its content. By perceiving digital evidence visually, investigators are able to speed up the forensic analysis process, and at the same time better comprehend new unique relationships between data as well as more easily comprehend it in terms of its global context.

To provide multiple snapshots of a directory-tree structure, we chose to utilize Shadow Copy (also known as Volume Snapshot Servie or Volume Shadow Copy Service or VSS), a technology included in Microsoft Windows which allows for the taking of manual or automatic backup copies or snapshots of data (including whole volumes) over regular intervals. VSS was chosen since it is a potential gold mine of forensic information, having been included in every version of Microsoft Windows since Windows XP.

In this thesis, we propose and develop a tool to take advantage of the information contained within VSS by applying the fisheye focus+context visualization approach to the directory tree structure, with a series of segmented boxes for each to represent change-over-time for each directory/file, accomplishing our goal of providing investigators a clear picture of how a directory-tree structure has changed over time at a glance.