Abstract: A digital forensic audit system which extracts the event and the document file from the image, analyzes the event and the document file to visualize the event and document file in order to analyze a user's behaviors by scanning a usage trace and a file which is an image recorded in a window system, the system includes a document file extracting unit which extracts a logical level document file and an attribute of the document file from the image; an event extracting unit which extracts an event including time of occurrence from the image and extracts an event from an attribute of the document file related to the time (hereinafter, referred to as a time attribute), an analyzing unit which analyzes the document file or the event by the attribute and the time; and a visualizing unit which displays the analyzed result (hereinafter, referred to as an analysis result) on a time coordinate.