From isolated clues to an investigation narrative

Threat & Timeline Analysis

Normalise timestamps, examine suspicious files and messages safely, and connect independent evidence into a supported sequence of activity.

Find my pathStart the foundations

Contextevidence in sequence

3analysis routes15practical tools1supported narrative

01

Build context safely

Select each stage to see how analysts turn varied evidence into a defensible account.

01ScopeSet question and safety 02PrepareProtect the inputs 03ExtractCollect useful facts 04CorrelateTest the narrative 05ReportExplain with confidence

Stage 1Define the question and safety boundary

Record the authorised evidence, relevant identities and systems, time range, and isolation requirements.

Ask: What must be answered, and what material needs special handling?

02

Find your analysis path

Choose the route that matches your primary evidence and investigation question.

I need to reconstruct activityI have a suspicious fileI have email evidence

Best matchStart with timeline and correlation

Normalise timestamps from several sources and reconstruct a supported sequence.

Sequence of activityTimeline & CorrelationCombine normalised timestamps and independent artefacts.Level Intermediate Evidence Multiple sourcesOutcome Produce a supported, reviewable activity sequence.Suspicious filesMalware AnalysisInspect properties, strings, structure, and capabilities in a safe environment.Level Intermediate Setup Isolated labOutcome Describe observable file characteristics and likely behaviour.Messages and mail storesEmail ForensicsExamine message metadata, content, attachments, and mailbox context.Level Beginner to intermediate Evidence Mail store or messageOutcome Reconstruct relevant message activity and provenance.

03

Build your foundation

Learn how to handle each evidence type before using the analysis tools.

1

Sequencing evidenceUnderstanding Timeline & Correlation

Normalise time and test a sequence across sources.

2

Suspicious filesUnderstanding Malware Analysis

Analyse safely and separate observation from attribution.

3

Message evidenceUnderstanding Email Forensics

Preserve and interpret mail stores, headers, and attachments.

04

Choose a tool by task

Use one focused tool first, then corroborate important results with another method.

TIMEFile-system timelineParse and sequence MFT data PEStatic file triageInspect without execution CAPAFile capabilitiesDescribe likely behaviours MAILMail storesReview messages and attachments

Best starting point for MFT-derived timelinesMFTECmd

Parse NTFS Master File Table records into structured output for filtering and timeline correlation.

Also consider Plaso for multi-source super-timelines or The Sleuth Kit for broader file-system examination.

Explore MFTECmd

05

Check investigation readiness

Prepare the evidence, time context, and isolation boundary before analysis.

!

Preparation required5 checks remaining.

I retained originals and recorded integrity hashes.I recorded source time zones and the normalisation standard.Suspicious material will be handled in an isolated, authorised environment.I will record commands, versions, settings, and exported results.I will separate observed facts, interpretation, and attribution.