Process and analysis
What is Timeline analysis?
Putting events from many evidence sources into a single time-ordered sequence to reconstruct what happened during an incident.
Timeline analysis merges timestamps from many sources, such as file system metadata, event logs, browser history, prefetch, registry keys and network logs, into one chronological view. Patterns that are invisible in any single source become obvious when everything is in order.
Time zones and clock drift are the usual traps. Converting everything to UTC and noting each source's reliability keeps the timeline honest.