Digital Forensics · 5 min
Building a Forensic Timeline
Correlating sources into a sequence you can defend
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Normalise before you correlate
A timeline is only meaningful once every event is expressed the same way. Normalisation is the unglamorous step that makes the rest possible.
- Convert every timestamp to a single reference timezone and record which
- Note the precision of each source — seconds, minutes or coarser
- Record which system produced each event, never merge sources anonymously
Clock skew and gaps
Systems drift. Agents batch. Logs rotate. A timeline should show its own weaknesses rather than paper over them.
- Skew: a source's clock is offset; ordering across sources may be wrong by that margin
- Batching: the recorded time may be when the event was shipped, not when it happened
- Gaps: no coverage during a window is not evidence that nothing happened
Loading the interactive lesson…