Skip to content

Understanding Timeline & Correlation

Timeline analysis organises evidence by time; correlation connects those observations by shared systems, users, files, identifiers, and activity.

What you will learn

By the end, you should be able to normalise timestamps, distinguish observation from inference, and build a timeline that remains traceable to source evidence.

What is timeline analysis?

Core concept

A forensic timeline brings selected observations into a consistent structure and time standard. Correlation tests whether independent sources support the same sequence rather than treating chronological proximity as proof of causation.

TimestampSourceSystemUserActivity

Keep in mind: Two events occurring close together may be related, coincidental, delayed, or recorded by clocks with different accuracy.

01NormalisationConverting values into a consistent representation02Source timeThe timestamp exactly as represented by the evidence source03Super-timelineA combined timeline built from several artefact types

Timeline record types

ObservedA value directly represented by the source artefact
DerivedA value calculated or transformed during processing
InferredAn interpretation connecting observations
CorroboratedA finding supported by independent sources

Why it matters

Sequence activity

Normalised records help show what happened before, during, and after an event.

Combine sources

File, event, browser, Registry, memory, and network records can be compared.

Expose gaps

A timeline makes missing periods, clock differences, and unsupported assumptions visible.

Support reporting

Traceable rows connect narrative findings to reproducible evidence.

How timeline analysis works

  1. DefineSet the investigation question, entities, and broad time window.
  2. ExtractParse relevant sources while preserving source path, tool, and timestamp meaning.
  3. NormaliseConvert time consistently without discarding original values or precision.
  4. Filter and correlateConnect shared identifiers and test alternative explanations.
  5. ReportPresent supported sequences with citations, uncertainty, and known gaps.

Choose the next step

ScenarioTwo artefacts differ by exactly 12 hours. What is the best first explanation to test?

Keep source and interpretation separate

  1. 1PreserveRetain source values and provenance.
  2. 2NormaliseDocument time standard and precision.
  3. 3CorrelateConnect entities across independent sources.
  4. 4ExplainState confidence, conflicts, and gaps.

Timeline tools in SUSA

MFT timelines

MFTECmd

Parse MFT records into structured output for filtering and correlation.

Multi-source timelines

Plaso

Extract events from many artefact types into a forensic timeline.

File-system analysis

The Sleuth Kit

Examine file-system structures and produce timeline-related data.

Continue learning