One of the primary goals of forensic analysis is to reconstruct the events surrounding a crime. Three common analysis techniques that are used in crime reconstruction are temporal, functional, and relational analysis.
The most common form of temporal analysis is the time line, but there is such an abundance of
temporal information on computers that the different approaches to analyzing this information are
limited only by our imagination and current tools.
The goal of functional analysis is to understand what actions were possible within the
environment of the offense, and how the malware actually behaves within the environment (as
opposed to what it was capable of doing).