Evidences used for computer forensics are usually distributed in heterogeneous event logs.Fusing heterogeneous event logs into scenarios is meaningful for aiding computer forensics.

• 摘要计算机取证牵涉的证据通常分布在多种不同的日志中，从多源日志进行事件场景关联对于辅助取证意义重大。