Supporting Process Mining with Recovered Residual Data - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2020

Supporting Process Mining with Recovered Residual Data

Ludwig Englbrecht
  • Function : Author
  • PersonId : 1117198
Stefan Schönig
  • Function : Author
  • PersonId : 1117199
Günther Pernul
  • Function : Author
  • PersonId : 1117200


Understanding how workflows are actually carried out within an organization can provide a crucial contribution to business process improvement. This paper presents a concept for reconstructing a business process by using file residuals on a hard-drive and without the need for existing event logs. Thereby, methods from the area of process mining are enriched with approaches from digital forensics investigations in a Digital Trace Miner. First, a framework that extracts traces originating from business process execution based on residual data is developed in order to link them to the processes. The traces from the extraction are used in a life-cycle to keep related data up-to-date. This approach has been implemented and evaluated by a prototype. The evaluation shows that this approach enables useful insights regarding the tasks performed on a suspect computer by associating recovered files by using file-carving mechanisms.
Fichier principal
Vignette du fichier
500489_1_En_27_Chapter.pdf (986.48 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03434664 , version 1 (18-11-2021)





Ludwig Englbrecht, Stefan Schönig, Günther Pernul. Supporting Process Mining with Recovered Residual Data. 13th IFIP WG 8.1 Working Conference on the Practice of Enterprise Modeling (PoEM 2020), Nov 2020, Riga, Latvia. pp.389-404, ⟨10.1007/978-3-030-63479-7_27⟩. ⟨hal-03434664⟩
36 View
20 Download



Gmail Facebook X LinkedIn More