Timeline Reconstruction
Definition
The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference (typically UTC), identifying and accounting for clock-skew, and cross-referencing entries from different log sources to build a coherent narrative.
- Input
- Digital events from multiple log sources
- Normalisation
- Common time reference, typically UTC
- Key challenge
- Identifying and correcting clock skew
- Output
- Single chronological narrative of events
Common questions
Why is clock skew such a persistent problem in timeline reconstruction?+
Devices and servers rarely have perfectly synchronised clocks, and skew can drift over time or reset after a reboot, so a raw timestamp comparison across sources can misorder events unless the analyst calibrates each source against a known reference point.
How do analysts handle conflicting timestamps from different sources?+
They look for corroborating events, such as a network packet timestamp and a matching application log entry, to cross-check and anchor uncertain sources. Where sources cannot be reconciled, the uncertainty is documented rather than silently resolved.
What tools are commonly used to build a digital timeline?+
Tools such as log2timeline and Plaso aggregate timestamped artefacts from file systems, browser history, registry entries, and application logs into a single sortable timeline for the analyst to review and filter.
Related terms
- Action Item
- A specific, time-bound improvement task generated by a post-incident finding. An action item has a named owner, a target completion date, a...
- Anomaly Scoring
- A numeric score assigned to each entity or transaction based on how different it is from the expected population, derived from multiple...
- Blameless Post-Mortem
- A cultural approach to post-incident review, popularised in site reliability engineering, in which the analysis focuses on systemic and process failures rather...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Explainability
- The degree to which a model's output can be explained in terms of its inputs and logic. Logistic regression and decision trees...
- Hypothesis Testing
- In digital forensics, the practice of forming a specific, falsifiable proposition about what occurred (such as 'the attacker used account X to...
- Isolation Forest
- An unsupervised machine-learning model for anomaly detection. It builds random decision trees and scores each record by the average depth required to...
- Lessons-Learned Register
- A persistent record, maintained by the security programme, that links each post-incident action item to the originating incident, tracks its status, and...
- Link Analysis
- A graph-based analytical technique that maps entities (IP addresses, domains, accounts, phone numbers, wallets) as nodes and relationships (communications, ownership, transactions) as...
- Logistic Regression (Supervised Fraud Model)
- A classification model trained on historically labelled transactions (fraud vs. legitimate) to estimate the probability that a new transaction is fraudulent. Requires...
- NetFlow
- A network protocol (originally Cisco, now standardised as IPFIX under RFC 7011) that records metadata about IP traffic flows: source and destination...
- Network Analysis (Link Analysis)
- A method that models entities (people, companies, accounts, addresses) as nodes and connections between them (shared attributes, transactions, ownership) as edges, then...
Explained in these topics
- Cyber Investigation Tools and Analytical Workflow
- Data Analytics in Fraud InvestigationsThe assembly of events from multiple data sources onto a chronological axis to establish the sequence of actions in a fraud: when accounts were created, when t...
- Post-Incident Review and Lessons LearnedThe process of assembling a chronological sequence of events during an incident from log data, SIEM alerts, ticket timestamps, network captures, and responder...