Systems and methods for cross-referencing forensic snapshot over time for root-cause analysis

A system for cross-referencing forensic snapshots over time, the system comprising:

• a hardware processor configured to:
• receive a first snapshot of a computing device at a first time and a second snapshot of the computing device at a second time;
• apply a pre-defined filter to the first snapshot and the second snapshot, wherein the pre-defined filter includes a list of files that are to be extracted from each snapshot;
• subsequent to applying the pre-defined filter, identify differences in the list of files extracted from the first snapshot and the second snapshot;
• create a change map for the computing device that comprises the differences in the list of files over a period of time, wherein the period of time comprises the first time and the second time;
• output the change map in a user interface, wherein the change map indicates changes made by the user and changes made by an unauthorized entity;
• and
• filter the change map to not show the changes made by the user.

A non-transitory computer readable medium storing thereon computer executable instructions for cross-referencing forensic snapshots over time, including instructions for:

• receiving a first snapshot of a computing device at a first time and a second snapshot of the computing device at a second time;
• applying a pre-defined filter to the first snapshot and the second snapshot, wherein the pre-defined filter includes a list of files that are to be extracted from each snapshot;
• subsequent to applying the pre-defined filter, identifying differences in the list of files extracted from the first snapshot and the second snapshot;
• creating a change map for the computing device that comprises the differences in the list of files over a period of time, wherein the period of time comprises the first time and the second time;
• outputting the change map in a user interface, wherein the change map indicates changes made by the user and changes made by an unauthorized entity;
• and
• filtering the change map to not show the changes made by the user.