Practice Lab · 09 · Forensics
Forensics Evidence Timeline
Reconstruct a fictional sequence of events by correlating authentication, browser, file, process, network, and scheduled activity evidence without altering the original artifacts.
This lab focuses on evidence reasoning. A reliable timeline is built from multiple independent sources, not a single timestamp.
Lab Snapshot
Mission briefing
Reconstruct the sequence without changing the evidence
This fictional forensics lab uses an authorized practice workstation and a prepared evidence set.
Your goal is to reconstruct a timeline without altering the original evidence.
Preserve original filenames, paths, timestamps, and hashes before drawing conclusions.
Different timestamp types can mean different things; do not treat every time value as proof of user action.
Authentication, process, scheduled-task, browser, and file evidence should be correlated rather than analyzed in isolation.
A single artifact may be misleading unless another source supports the same event.
Do not rename, move, delete, or edit evidence files during the investigation.
Document what is directly observed separately from what is inferred.
Evidence sources
Know what each artifact can and cannot prove
File-system timestamps
Use timestamps as timeline anchors, but remember that copying, extraction, synchronization, and system behavior can alter them.
Authentication events
Establish when identities authenticated or changed privilege and correlate those events with later activity.
Process and service activity
Connect a file or command with actual execution rather than assuming presence means use.
Scheduled activity
Identify recurring or delayed execution that may explain activity outside an interactive session.
Browser and download artifacts
Add context around how a file may have arrived and what the user was doing around that time.
Network evidence
Correlate execution with communication and distinguish local-only activity from network-facing behavior.
Timestamp rule
A timestamp is evidence of time context, not automatic proof of action
Copying, extraction, synchronization, time zones, and system behavior can all affect timestamp interpretation. Correlate timestamps with logs and execution evidence before forming conclusions.
Windows collection
Collect timeline evidence without changing it
Authentication events
Review successful and failed logons, special privileges, and account creation.
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624,4625,4672,4720} -MaxEvents 80Process creation
Use process-creation auditing when available to correlate execution with user and command-line context.
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 80Service installation
Identify recently installed services and correlate their executable paths with the file timeline.
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 40Scheduled tasks
Review configured tasks, triggers, and run history where available.
Get-ScheduledTask
Get-ScheduledTaskInfo -TaskName "ExampleTask"
Linux collection
Use logs, schedules, and metadata as independent evidence
Authentication timeline
Review authentication and sudo activity with timestamps.
sudo grep -Ei "accepted|failed|sudo|session opened|session closed" /var/log/auth.log 2>/dev/null | tail -n 120
Journal timeline
Use the system journal to correlate services, processes, and failures.
journalctl --since today --no-pager
journalctl -p warning --since today --no-pager
Cron and timers
Identify recurring execution sources that may explain events outside interactive sessions.
crontab -l
sudo crontab -l
systemctl list-timers --all
File metadata
Record file timestamps and hash without modifying the file.
stat /path/to/evidence-file
sha256sum /path/to/evidence-file
Fictional evidence set
Build the event sequence
A successful logon event shows user Jordan signed in interactively.
Investigation prompt
What later artifacts would you expect to fall within or shortly after this session if Jordan initiated them?
The browser history shows a visit to a fictional software download page.
Investigation prompt
What additional artifact would help prove that a file was actually downloaded rather than only viewed?
A file named update-tool.zip appears in Downloads with a created timestamp near 09:20.
Investigation prompt
Why is the created timestamp useful but not sufficient by itself to prove execution?
An executable extracted from the archive has a modified timestamp older than the download event.
Investigation prompt
Why can an extracted file legitimately have an older modified timestamp than the archive arrival time?
A process-creation event shows update-tool.exe launched from the user's Downloads folder.
Investigation prompt
How does this strengthen the timeline compared with file presence alone?
The same process ID is associated with an outbound connection to a fictional external endpoint.
Investigation prompt
What new behavior does this add to the timeline?
A scheduled task named UpdateCheck was created to run update-tool.exe at user logon.
Investigation prompt
How does this change the interpretation from one-time execution to persistence?
Jordan logs off. The scheduled task remains configured.
Investigation prompt
Why is this important when predicting what might happen at the next logon?
Timeline method
Turn artifacts into a defensible sequence
Normalize time
Record timezone, clock source, and timestamp format before comparing artifacts.
List direct observations
Write down what each artifact actually says without adding interpretation.
Group by event
Cluster artifacts that appear to describe the same action, such as download, execution, or logon.
Correlate identities
Connect user sessions and privilege events to process, file, and network activity.
Separate fact from inference
Mark conclusions that are supported by multiple artifacts but are not directly recorded by any one source.
Verify sequence
Check whether the event order makes technical sense and investigate contradictions instead of forcing them to fit.
Timestamp warnings
Common reasons timestamps can mislead you
A modified timestamp may reflect the original source file rather than when it arrived on the system.
Archive extraction can preserve or alter timestamps depending on the tool and format.
Copying a file can change created time while leaving modified time intact.
System clocks and time zones can make two valid artifacts appear out of order.
Accessed time may be disabled, delayed, or updated inconsistently.
Log ingestion time is not always the same as event occurrence time.
A timestamp proves timing context, not user intent.
The strongest timelines use multiple independent sources.
Preserve first
Keep the original evidence intact
Record SHA-256 hashes for evidence files before analysis.
Work from copies whenever possible.
Record original path, filename, size, owner, and timestamps.
Record event-log source, event ID, timestamp, account, and relevant fields.
Record process PID, parent PID, executable path, and command line.
Record scheduled-task action, trigger, run-as account, and last-run details.
Record network endpoints and owning process information.
Document every inference separately from direct observation.
Reconstructed timeline
One defensible interpretation of the fictional evidence
This table models how to present a timeline while keeping confidence explicit.
| Time | Event | Sources | Confidence |
|---|---|---|---|
| 09:12 | Interactive logon | Authentication event | High |
| 09:18 | Software page visited | Browser history | High |
| 09:20 | Archive appears in Downloads | File metadata + download artifact | High |
| 09:23 | Executable extracted | File-system metadata | Medium |
| 09:26 | Executable launched | Process-creation event | High |
| 09:27 | Outbound connection observed | Network + process correlation | High |
| 09:31 | Persistence configured | Scheduled-task evidence | High |
| 10:04 | Interactive session ends | Authentication event | High |
Reflection
Debrief the timeline reasoning
Why is file presence weaker evidence than process-creation evidence?
Why can created and modified timestamps appear out of chronological order?
What is the difference between a direct observation and an inference in a forensic timeline?
Why should authentication events be correlated with process activity?
How does a scheduled task change the interpretation of one-time execution?
Why is an outbound network connection stronger when tied to a specific PID?
What should you do when two artifacts appear to contradict each other?
Which artifact in this lab gives the strongest evidence of execution, and why?
Completion checklist
Finish only when the sequence is supported by evidence
I recorded timezone and timestamp context before comparing artifacts.
I separated direct observations from inferences.
I preserved file hashes and metadata before analysis.
I correlated authentication with process and network evidence.
I used more than one source to support major conclusions.
I identified the difference between file arrival and execution.
I identified the evidence suggesting persistence.
I documented the event sequence without altering the original evidence.
I investigated timestamp contradictions instead of ignoring them.
I can explain the confidence level of each major timeline event.