Forensics · Lesson 16
Timeline Reconstruction & Correlation
Learn how to combine authentication, browser, filesystem, process, service, scheduler, network, and security evidence into one defensible sequence.
A strong timeline preserves original timestamps, normalizes them carefully, labels uncertainty, and never invents missing steps.
Lesson Snapshot
Learning objectives
Build timelines that expose evidence and uncertainty
Explain why a forensic timeline must combine evidence from multiple sources rather than rely on one timestamp.
Normalize timestamps across sources while preserving original timezone and timestamp-type context.
Distinguish direct observations from inferred sequence and explicitly document uncertainty.
Correlate authentication, browser, file, process, service, scheduled-task, network, and security-product evidence.
Recognize how copying, extraction, clock differences, log rotation, and delayed writes can distort apparent order.
Build a concise evidence-backed event sequence that answers the forensic question without inventing missing steps.
Core idea
A timeline is only as strong as the evidence links inside it
Build the sequence from independent artifacts, preserve the original timestamp context, and mark which links are direct versus inferred.
Competition caution
Do not force the evidence into a story
If the timeline has a gap, document the gap. An incomplete but defensible answer is stronger than a complete story built on assumptions.
Timeline principles
Keep sequence, timestamp meaning, and uncertainty separate
A timeline is a model of evidence
It organizes observed events into sequence. It does not magically fill gaps or prove that every unobserved step occurred.
Timestamp type matters
Creation time, modification time, access time, log time, browser time, and internal document/archive time describe different events.
Timezone must be explicit
Two correct timestamps can appear inconsistent if they are displayed in different timezones or offsets.
Corroboration raises confidence
A browser download record, matching file creation, process launch, and network connection together create a stronger sequence than any one artifact alone.
Absence is not proof
Missing logs, overwritten history, disabled auditing, or incomplete records do not prove an event never happened.
Your own actions enter the timeline
Defensive changes, reboots, service stops, file moves, and scans can create new evidence that must be separated from the original state.
Timestamp types
Label what each time actually represents
Log timestamp
When an event source recorded an event.
Caution
Depends on system clock, logging configuration, and timezone display.
Filesystem creation / birth
When a local filesystem entry was created where supported.
Caution
Copying or extraction can create a new local timestamp unrelated to original content age.
Modification time
When file content was last changed according to that filesystem or format.
Caution
Can be preserved during archive extraction or copying.
Access time
When a file was accessed under the filesystem's update rules.
Caution
May be delayed, disabled, coarse, or changed by automated processes.
Document-internal time
Timestamp stored inside a document or application format.
Caution
Can survive copies and may not match local filesystem history.
Archive-internal time
Timestamp stored for a file inside an archive.
Caution
Can be much older than local archive download or extraction.
Browser time
Time stored for a page visit, download, or other browser event.
Caution
Browser databases may use different timestamp formats internally.
Process start time
When a process instance began.
Caution
Useful only while the process or supporting logs remain available.
Normalization workflow
Compare times without losing their original meaning
Record the original timestamp
Do not overwrite the evidence value. Keep the exact displayed value, source, timestamp type, and timezone or offset.
Identify the clock source
Determine which host, application, filesystem, or archive produced the time.
Normalize for comparison
Convert copies of the timestamps to one comparison timezone when necessary while preserving the originals.
Label the timestamp type
Creation, modification, event-recorded, browser, process start, and archive times should never be mixed without labels.
Check clock reliability
Consider clock drift, virtual-machine snapshots, manual clock changes, or unsynchronized systems when evidence appears inconsistent.
Compare sequence, not just equality
Look for events that logically precede or follow one another and identify where the evidence leaves gaps.
Confidence
State how strongly the evidence supports the link
High
Multiple independent sources agree and directly support the sequence.
Moderate
Evidence is consistent but one important link is indirect or incomplete.
Low
Only one weak source exists or multiple explanations remain plausible.
Insufficient
The available evidence cannot responsibly answer the question.
Evidence categories
Build the timeline from independent sources
Authentication
Windows logons, SSH sessions, sudo activity, PAM records, RDP evidence.
Timeline use
Establishes when an account session began, failed, succeeded, or changed privilege context.
Browser & download
Visited URL, download record, destination path, browser profile.
Timeline use
Establishes browsing and file-arrival context.
Filesystem
Creation, modification, path, owner, size, hash, archive extraction.
Timeline use
Places files into local context and tracks transformations.
Process
PID, parent PID, path, command line, start time, user.
Timeline use
Shows actual execution and launch relationships.
Service / startup
Service install/start, systemd unit, startup entry, scheduled task, cron.
Timeline use
Explains persistence and automatic execution.
Network
Listeners, established connections, source/remote address, owning PID.
Timeline use
Connects running processes to network activity.
Security product
Defender or endpoint scan/detection records.
Timeline use
Adds independent file/process/security context.
Team changes
Service disabled, account removed, firewall rule changed, file quarantined.
Timeline use
Separates original evidence from defensive actions.
Observation vs inference
Keep evidence statements separate from interpretation
Browser record shows tools.zip downloaded at 09:14.
Direct observation
The browser artifact directly records a download event.
The user intentionally downloaded tools.zip.
Inference
The artifact shows the browser recorded a download, but intent requires additional context.
PowerShell process started at 09:18 with helper.ps1 in the command line.
Direct observation
Process evidence directly records the executable and argument.
The downloaded archive caused the PowerShell execution.
Correlated inference
This can become strong if extraction, matching paths/hashes, and task/process evidence connect the events.
A connection to 203.0.113.40:443 occurred at 09:19.
Direct observation
Network-state or application evidence records the connection.
The remote host was malicious.
Unsupported from timeline alone
A connection and endpoint do not establish intent or reputation by themselves.
Common sequences
Recognize useful event patterns without assuming causation
Authentication → browser activity → download → file creation
Useful for reconstructing how a file arrived during a user session.
Download → extraction → script/process start
Useful for separating arrival from later execution.
Account creation → privileged-group change → login
Useful for reconstructing account lifecycle and privilege sequence.
Task creation → task trigger → process start
Useful for proving scheduled execution.
Package install → service creation → service start → listener
Useful for explaining new services and network exposure.
Config change → service restart → new behavior
Useful for connecting configuration edits to service-state changes.
Transformations
Know how file operations distort apparent time
Copy
May create a new local creation timestamp while preserving modification time depending on tool and filesystem.
Archive extraction
Can create new local files while preserving older archive-internal modification times.
Rename
Changes path/name without changing file content or hash.
Edit
Usually changes content and therefore the file hash and modification time.
Move on same filesystem
May preserve many timestamps while changing path.
Restore / snapshot
Can make local timestamps appear older than surrounding system events.
Clock problems
Explain timestamp disagreement before declaring contradiction
Timezone mismatch
Events appear hours apart but align after converting offsets.
Clock drift
One host consistently records events slightly ahead or behind another.
Manual time change
System events appear to move backward or jump forward.
VM snapshot restore
Filesystem or system state appears older than later external records.
Log ingestion delay
Centralized log time differs from event-generation time.
Rounded timestamps
Different sources record only seconds or minutes, creating apparent ties.
Timeline entry
Record enough context for another teammate to verify the event
Normalized time
Original time
Timezone / offset
Source host
Evidence source
Timestamp type
Observed event
Account / process
Path / object
Identifier / hash
Confidence
Corroboration
Notes / uncertainty
Worked example
Build one timeline from multiple evidence categories
What can be stated directly?
The account logged on, the archive was downloaded, a script appeared locally, a task was registered, PowerShell executed the script path, and a related process made a network connection.
What requires correlation?
That the extracted script came from the downloaded archive and that the task caused the later PowerShell launch.
What should not be claimed?
That the user intended harm or that the remote host was malicious without additional evidence.
Windows
Collect timestamped evidence for correlation
Recent Security events
Get-WinEvent -LogName Security -MaxEvents 50 | Select-Object TimeCreated,Id,ProviderName,Message
Provides timestamped authentication and account-related events where permissions and auditing allow.
System events
Get-WinEvent -LogName System -MaxEvents 50 | Select-Object TimeCreated,Id,ProviderName,Message
Adds service, boot, driver, and system-event context.
Process inventory
Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Provides process relationships for correlation.
File timestamps
Get-Item "C:\Users\trainee\Downloads\training-tools.zip" | Format-List Name,FullName,CreationTime,LastWriteTime,LastAccessTime,Length
Adds local filesystem time context.
Linux
Collect timestamped evidence for correlation
Journal time window
journalctl --since "2026-10-10 09:00:00" --until "2026-10-10 10:00:00"
Reviews systemd journal activity for a bounded time range.
Authentication log window
grep "Oct 10 09:" /var/log/auth.log
Illustrative filter for authentication records when auth.log exists and date format matches.
Process view
ps -eo pid,ppid,user,lstart,cmd
Adds process start and parent-child context.
File timestamps
stat /home/trainee/Downloads/training-tools.zip
Adds Linux filesystem time and ownership context.
Correlation
Use multiple independent artifacts to strengthen each link
Successful login 09:02 + browser download 09:08 + file creation 09:08
Supported conclusion
The download occurred during the authenticated session and aligns with the local file appearance.
Archive download 09:08 + extracted script local creation 09:11 + matching archive path/name
Supported conclusion
The archive is a plausible source for the extracted script, with moderate confidence unless hash/content comparison confirms it.
Task registered 09:14 + trigger 09:20 + PowerShell command line references same script
Supported conclusion
The scheduled task likely caused the PowerShell execution.
PowerShell execution 09:20 + child process 09:20 + network connection 09:21
Supported conclusion
The network activity closely follows the process chain.
Service config edited 11:05 + service restart 11:06 + new listener 11:07
Supported conclusion
The service behavior changed immediately after configuration and restart.
Linux sudo command 12:10 + file mtime 12:10 + service restart 12:11
Supported conclusion
The privileged command, file modification, and restart form a coherent administrative sequence.
Contradictions
Investigate disagreement instead of forcing a match
Browser download occurs after file mtime
Check whether the file came from an archive or copy that preserved an older modification time.
Logon appears after application activity
Check timezone, cached sessions, service accounts, remote sessions, and clock drift before declaring contradiction.
Process start appears before task creation
The process may have had another launch source, or the task-registration time may not represent the first execution mechanism.
Network event exists but process is gone
Use logs, PID references, service/task configuration, and neighboring events to reconstruct the earlier process context.
Security product time differs by minutes
Check event-generation time versus scan, detection, or ingestion time.
Two sources disagree on seconds
Document the discrepancy and use sequence plus broader timing rather than forcing exact equality.
Common mistakes
Timeline mistakes that turn evidence into assumptions
Sorting without labeling timestamp type
A creation time and a modification time can describe different events and should not be treated as interchangeable.
Converting times and losing originals
Always preserve the source timestamp and timezone before creating a normalized copy.
Treating sequence as causation
One event occurring before another does not automatically prove it caused the later event.
Ignoring archive and copy behavior
Preserved timestamps can make files appear to predate local arrival.
Filling gaps with assumptions
A timeline should expose missing evidence, not hide it.
Ignoring team changes
Your own hardening actions can create events that look like original system activity.
Forcing exact timestamp matches
Different sources may round, delay, or record events at slightly different moments.
Using one source as the whole story
Strong timelines combine independent evidence categories.
Fictional timeline lab
Correlate session, download, extraction, cron, process, and network evidence
student11 successful SSH login from fictional 192.0.2.77.
Browser downloads admin-kit.tar.gz.
admin-kit.tar.gz appears in Downloads.
maint.sh appears under ~/.local/bin; internal archive mtime is from 2025.
User crontab is changed to run maint.sh every 10 minutes.
Cron launches maint.sh.
maint.sh launches a child process.
Child process connects to fictional 203.0.113.155:443.
Task 01
Which event establishes the remote session?
The 14:00:03 SSH authentication record.
Task 02
Why does the 2025 mtime not prove maint.sh existed locally in 2025?
The timestamp may have been preserved inside the downloaded archive and carried through extraction.
Task 03
What evidence most strongly connects cron to process execution?
The crontab change, cron launch at 14:10:00, and immediate process activity at 14:10:02.
Task 04
What connects the process chain to network activity?
The child process appears immediately before the connection at 14:10:05.
Task 05
What remains uncertain?
Intent, authorization, and the purpose of the remote endpoint require scenario or additional evidence.
Task 06
How should confidence be expressed?
Use high confidence for directly corroborated events, moderate confidence for inferred links, and explicitly mark unsupported conclusions.
Timeline template
Turn evidence into a concise forensic answer
Question
How did helper.ps1 arrive and execute?
Scope
CP-WIN-12, 09:00-09:30 local time.
Sources
Security, browser, filesystem, Task Scheduler, process, network.
Normalization
All comparison times converted to EDT; originals preserved.
Sequence
Login → download → extraction → task registration → execution → connection.
Confidence
High for direct events, moderate for causal links.
Gaps
No direct artifact proves who initiated the download.
Conclusion
State only what the combined evidence supports.
Lesson checklist
Before moving on
I preserve original timestamps before normalization.
I label timestamp type and timezone.
I identify which host or application produced each time.
I distinguish direct observations from inferences.
I use more than one evidence source for important links.
I account for archive, copy, and extraction behavior.
I consider clock drift and VM/snapshot effects.
I separate original system activity from my team's changes.
I record contradictions instead of hiding them.
I use confidence labels when evidence is incomplete.
I do not treat sequence alone as proof of causation.
I end with a concise conclusion tied to the original question.
Reflection
Check your timeline reasoning
Question 1
Why must timestamp type be recorded alongside the timestamp itself?
Question 2
What makes a timeline correlation stronger than a single log entry?
Question 3
How can archive extraction make a file appear older than its local arrival?
Question 4
Why does event order fail to prove causation by itself?
Question 5
How should you handle two sources whose clocks differ by a few minutes?
Question 6
What belongs in the final conclusion when some steps remain uncertain?
Carry this forward
Preserve original times, normalize carefully, correlate across independent sources, label confidence, expose gaps, and answer only what the evidence supports.