Multi-Device Timeline Fusion
Final year research project reconstructing a unified timeline from multiple independent devices while explicitly measuring how reliable that reconstruction is — defensible alignment, not just alignment. Built as a deterministic six-stage pipeline: logs are parsed, timestamps normalised to UTC, overlapping events detected, median-based clock-skew offsets calculated and applied, events fused and clustered, and cluster-level confidence scores assigned. Confidence is modelled as an exponential decay over weighted uncertainty components (temporal variance, cluster completeness, skew spread, and cluster size), so uncertainty is explicitly propagated rather than assumed. Each event preserves full provenance — original and corrected timestamps, cluster and device IDs, and SHA-256 hashes — with results exported to JSON and SQLite. Evaluated under controlled synthetic noise: mean absolute error degrades predictably and bounded (~27s to ~38s) while ordering accuracy stays at 1.0 across all noise levels, preserving the relative event sequence that matters most in forensic analysis. Identical input always produces identical output, supporting forensic defensibility and reproducibility.