Skip to Main content Skip to Navigation
New interface
Conference papers

Supporting Process Mining with Recovered Residual Data

Abstract : Understanding how workflows are actually carried out within an organization can provide a crucial contribution to business process improvement. This paper presents a concept for reconstructing a business process by using file residuals on a hard-drive and without the need for existing event logs. Thereby, methods from the area of process mining are enriched with approaches from digital forensics investigations in a Digital Trace Miner. First, a framework that extracts traces originating from business process execution based on residual data is developed in order to link them to the processes. The traces from the extraction are used in a life-cycle to keep related data up-to-date. This approach has been implemented and evaluated by a prototype. The evaluation shows that this approach enables useful insights regarding the tasks performed on a suspect computer by associating recovered files by using file-carving mechanisms.
Document type :
Conference papers
Complete list of metadata
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Thursday, November 18, 2021 - 1:39:33 PM
Last modification on : Friday, November 19, 2021 - 4:56:19 PM
Long-term archiving on: : Saturday, February 19, 2022 - 7:05:28 PM


 Restricted access
To satisfy the distribution rights of the publisher, the document is embargoed until : 2023-01-01

Please log in to resquest access to the document


Distributed under a Creative Commons Attribution 4.0 International License




Ludwig Englbrecht, Stefan Schönig, Günther Pernul. Supporting Process Mining with Recovered Residual Data. 13th IFIP WG 8.1 Working Conference on the Practice of Enterprise Modeling (PoEM 2020), Nov 2020, Riga, Latvia. pp.389-404, ⟨10.1007/978-3-030-63479-7_27⟩. ⟨hal-03434664⟩



Record views