Skip to content

Timeline analysis

Timeline analysis is the process of collecting, correlating and ordering the date and time values of artifacts found on a computer system into a single chronological record of its activity.

These date and time values comes from many sources:

  • file system timestamps,
  • Windows Registry keys,
  • event logs,
  • browser history,
  • e-mail,
  • application and system log files
  • telemetry from supporting systems such as network equipment and proxies

Each source is parsed and normalized into one of the timeline formats, combined and sorted chronologically before it is examined to reconstruct what took place on the system, and in which order it took place.

Timeline analysis is frequently used to describe a particular workflow, but at its core it is a method: ordering artifacts in time and reading the resulting sequence. Investigations are usually addressed by first building a super timeline - a single timeline combining all the timestamped artifacts on the evidence - and then narrowing it down; where the amount of material is too large, or the question too specific, a timeline is analyzed in a targeted manner instead: the timeline is built from only those artifacts that are relevant to a particular user, file, program or time frame.

More fundamentally, timeline analysis is a matter of interpreting time rather than reading events: a timestamp is evidence of when something happened on a system, and on its own it rarely proves what happened. Every conclusion drawn from a sequence of entries - that a user logged in, that a program was executed, that a document was opened - is a hypothesis, whose reliability grows the more independent sources corroborate it.

The classic pitfalls are conflating a timestamp with the event it represents, ignoring time zones and an unknown system time, over-reading timestamps beyond the granularity of the file system, or accepting tampered timestamps (timestomping) at face value. A single, isolated timestamp is worth little; it is the pattern of many timestamps - across file systems, the Windows Registry, log files and network evidence - that establishes the sequence of events.

Timeline creation

Creating a timeline means identifying the timestamped artifacts on the evidence, extracting them and normalizing their time, source and description into a common timeline format such as body file or L2T CSV. The work is done by purpose-built engines: Plaso, for example, parses file systems, the Windows Registry and a wide range of log and application artifact formats into a single correlated timeline, while mactime from The Sleuth Kit turns the body file of a file system into a sorted timeline. Creation and analysis are normally kept apart: the timeline is produced as a file - a product of the examination - and then examined with analysis and visualization tools.

See also Timeline creation tools.

Timeline formats

A timeline is only as good as the format in which it is exchanged. Each format carries a different set of fields (date/time, source, host, user, description), a different time granularity and a known set of limitations - most commonly second-only resolution and no indication of the time zone - that silently distort the interpretation if the investigator does not know about them.

The timeline formats described in this wiki are:

  • body file - pipe-separated "intermediate" timeline introduced by the grave-robber tool of The Coroner's Toolkit and adopted by The Sleuth Kit; not sorted chronologically, but staged for post-processing with mactime
  • L2T CSV - the 17-field CSV introduced by log2timeline, with the short and full description fields that visualization tools rely on
  • Mactime - the chronologically sorted timeline output of The Sleuth Kit
  • TLN - the pipe-separated Time|Source|Host|User|Description format introduced by Harlan Carvey, with the l2tTLN variant adding a time zone and a notes field

See also Tools: Timeline analysis.

Analyzing timelines

Once a timeline has been created, the analysis means reading through it: filtering and grouping entries by source, user or time of day, looking for the characteristic signatures of log on, program execution, file operations and network connections, and correlating the result with timelines from related systems - see for example the timeline correlation performed in network forensics. Timesketch supports this step with a collaborative, sketch-based workspace in which multiple investigators organize, annotate, tag, star and comment on the same set of timelines.

See also Timeline analysis tools.

Interpreting timestamps

Before a timeline can be interpreted, the meaning of its timestamps must be established. That means knowing what a value records - which of the MAC(B) or MACE values it is - relative to which epoch, at what granularity the file system records, and whether the system time and time zone of the machine are known.

Equally important is being able to rule out deliberate manipulation: timestomping and other anti-forensic techniques can shift timestamps to misleading values, while honest causes (time synchronization, time zone changes, daylight savings) can shift them too. The rigorous way to deal with this is through model-based and hypothesis-based approaches to the interpretation of timestamp evidence, including bounding the time of an event between the values of multiple timestamps. Where the system time itself is in question, the reference time can be established from independent sources, such as estimating the boot time and uptime of a machine from TCP timestamps.

Visualizing timelines

Timelines in real cases contain thousands to millions of entries, and reading them as text is not practical. Visualizations turn the timeline into a picture of its density and structure - trends, clusters of activity, and at least as important the gaps of inactivity between them - which is why visualization has been a central topic of timeline analysis research; see the Visualization section of the bibliography below. Purpose-built tools in this area are mostly discontinued, and current practice leans on the visualization capabilities of Timesketch and similar analysis tools.

See also

Bibliography

Articles / Blogposts

Papers

Visualization

  • ThemeRiver: In Search of Trends, Patterns, and Relationships, by Susan Havre, Beth Hetzler, and Lucy Nowell, Battelle Pacific Northwest Division, Richland, Washington, 1999
  • Visualizing gaps in time-based lists, by Moritz Stefaner, November 6, 2000