thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Timeline Analysis

Reconstructing the sequence of events in an incident by ordering timestamps from multiple artifacts.

Definition

Timelines combine file system MACB times, event logs, registry modifications, browser history and network logs to show attacker activity chronologically. Super timelines using tools like plaso/log2timeline merge many sources. Accurate time synchronization and time zone normalization are critical.

Example

A timeline showing a phishing attachment opened at 09:02, a scheduled task created at 09:04 and data upload at 11:30.

Exam tip

Normalize to UTC before correlating timestamps from different sources.

Related terms