Timeline analysis combines timestamps from across a system — file activity, logs, registry, browser and application artifacts — into one chronological sequence. It is how an examiner establishes what happened in what order, which is usually the question in dispute rather than what any single file contains.
Why a sequence beats an artifact
A single timestamp proves very little and is easy to attack: clocks drift, time zones are mishandled, tools normalise inconsistently, and timestamps can be altered outright.
A sequence assembled from independent sources is a different kind of evidence. When a USB device connection, a burst of file-open records, a large upload in the proxy log, and a badge-out record all fall within twenty minutes of each other, no single artifact carries the argument — the convergence does. Falsifying one timestamp is straightforward; falsifying a consistent story across six independent systems is not.
What goes into one
- File system times — created, modified, accessed, and the metadata-change time, which most users cannot alter and which frequently contradicts a manipulated visible timestamp.
- Registry and configuration — device connections, installed software, user preferences, each with its own last-written time.
- Event and audit logs — logons, service starts, log clearing, policy changes.
- Application artifacts — browser history, recent-document lists, jump lists, cloud sync client records.
- Link files, which record documents opened including from removable media long since disconnected.
- Off-device corroboration — mail server logs, VPN and proxy records, badge systems, phone records.
The last category is the one most often neglected and most often decisive, because it is outside the subject's control.
Time zones are where analyses go wrong
Different artifacts store time differently. Some record UTC, some local time, some the time zone active when the entry was written — which may not be the one configured now. Daylight-saving transitions add another hour of ambiguity twice a year.
An analysis that presents everything in one zone without stating the conversions applied is inviting a challenge it will lose. A careful report says what zone the timeline is expressed in, how each source was normalised, and whether the system clock was verified against an external reference.
We have seen conclusions collapse entirely on this point — an apparently damning sequence that dissolved once the machine's clock was found to be seven hours off.
Reading a timeline honestly
The discipline is to distinguish what the artifacts record from what they imply. A file-access record shows the file was opened, not that a person read it, and not that they understood what it contained — automated processes, indexing services and antivirus scanners all generate access records.
This is the same boundary that governs expert testimony generally: an examiner can establish the sequence, and inferring intent from it is argument rather than analysis. A report that keeps the two separate survives cross-examination. One that blends them hands the other side its cross.
From our work
Dealing with timeline analysis in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.