Timeline analysis

A timeline chronologically orders all of a system’s events —files, logs, registry, executions— to reconstruct the attack sequence: when it got in, what it did, and in what order. It’s the technique that unites all the evidence into a narrative.

Timeline types

Filesystem timeline   only files' MAC(B) times (from the $MFT/inodes)
Super timeline        EVERYTHING: FS + logs + registry + browser + artifacts
                      -> the full picture, far more context

MACB timestamps

M  Modified    last content modification
A  Accessed    last access (often disabled for performance)
C  Changed/MFT metadata change (NTFS: $STANDARD_INFORMATION)
B  Birth/Born  creation
# in NTFS, comparing $STANDARD_INFORMATION vs $FILE_NAME detects timestomping (anti-forensics)

Building with Plaso / log2timeline

log2timeline.py output.plaso image.dd     # extracts events from ALL sources
psort.py -o l2tcsv output.plaso > timeline.csv   # sorts and filters to CSV
# Timesketch: analyze/collaborate on the super timeline in the browser (filters, tags, graph)

Analysis workflow

1. scope the incident's time WINDOW (first known indicator)
2. filter noise (updates, legitimate activity) around that window
3. find the sequence: entry -> execution -> persistence -> lateral -> objective
4. anchor on high-value artifacts (execution, logins, account creation; see dfir-win-art)
5. correlate with memory (dfir-memoria) and network (dfir-red)

Pivot and correlate

- one artifact gives a time -> look for what else happened in that second/minute
- combine sources: 4624 (login) + Sysmon 1 (process) + $MFT (file) + netscan (C2)
- reconstruct the attack chain (dfir-cadena of events) and map to ATT&CK (cti-attack)

Blue Team / DFIR

The super timeline is the glue of DFIR: it turns loose artifacts into a defensible story.
Mind time zones and NTP: everything must be in UTC or normalized, or correlation lies.
Detect timestomping (SI vs FN) so you don’t trust manipulated timestamps.
Timesketch for collaboration and annotation; the result feeds the report and lessons learned.

Real-world cases

The super timeline with Plaso is standard in IR to date the intrusion and its sequence.
Detecting timestomping (timestomp/SetMace-type tools) via SI/FN discrepancy in $MFT.
Cases where time zone/NTP skew led to wrong conclusions until normalized to UTC.

Testing checklist

Scope the incident’s time window
Generate a super timeline (log2timeline/Plaso)
Normalize to UTC and verify NTP/time zones
Filter noise around the window
Reconstruct the sequence (entry→execution→persistence→lateral→objective)
Detect timestomping (SI vs FN in $MFT)
Correlate with memory/network and map to ATT&CK