Stratigraphy comes to our vocabulary from geology, where it refers to “1:geology that deals with the origin, composition, distribution, and succession of strata” and “2:the arrangement of strata” (Webster's, 2010). It then became very crucial in archeology for establishing chronology (Hirst, 2010). In forensics “the breadth of physical evidence that can be recovered is great, and that which can be lost without due attention to the buried surfaces forming an intrinsic part of the stratified deposits of a site is significant” (Hanson, 2004). In computer forensics the same can be said, even if the evidence, 'surfaces' and 'deposits' are mostly virtual.

Because of the way current operating systems use non-volatile storage, unless a magnetic media is intentionally wiped it is very likely that a great deal of data is recoverable. And because of the way the OSs allocate 'new' space, this data will very likely be 'buried' in strata that indicate the order in which it was generated, modified and 'deleted'. So by applying the same logical concept of 'unearthing' layers we can reconstruct likely timelines of events.

“When time markers are obliterated, more imaginative approaches are required to get a sense of when data was created” (Casey, 247). One example of such a case would be a computer with a dead CMOS battery on which a kidnapper was maintaining a series of ransom notes. Although it might be impossible to correlate the chronology of these communications with perfect accuracy it might well be possible to establish the order in which they were created using digital stratigraphy techniques. These might include imaging the entire hard drive(s) then searching for strings that pertained to the case and mapping all the files and fragments thereof, looking at editing history within them and determining the order in which the files were likely created, edited and/or deleted. So, if any note from the series could be pinpointed to a time via some external corroborating evidence the whole series might be established within a time frame.

Casey, E. (2004) Digital Evidence and Computer Crime – Forensic Science, Computers and the Internet, 2^nd edition, New York, Academic Press

Hanson, I.D. (2004) 'The importance of stratigraphy in forensic investigation', Geological Society, London, Special Publications, v. 232, p. 39-47 [Online]. Abstract available from: http://sp.lyellcollection.org/cgi/content/abstract/232/1/39 (Accessed: 20 June, 2010)

Hirst, K.K. (2010) Stratigraphy [Online]. Available from: http://archaeology.about.com/od/sterms/g/stratigraphy.htm (Accessed: 20 June, 2010)

Merriam Webster's Online Dictionary (2010) Stratigraphy [Online]. Available from: http://www.merriam-webster.com/dictionary/stratigraphy (Accessed: 20 June, 2010)