Chapter 24 — Digital forensics and malware analysis: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Why timelines"]
N2["24.2 Normalisation"]
N3["Lab — merging sources into a UTC timeline"]
N4["24.3 Reading the result"]
N5["24.4 Clock offsets"]
N6["24.5 Granularity"]
N7["24.6 Gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Why timelines"]
N2["24.2 Normalisation"]
N3["Lab — merging sources into a UTC timeline"]
N4["24.3 Reading the result"]
N5["24.4 Clock offsets"]
N6["24.5 Granularity"]
N7["24.6 Gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Why timelines]
|
v
[24.2 Normalisation]
|
v
[Lab — merging sources into a UTC timeline]
|
v
[24.3 Reading the result]
|
v
[24.4 Clock offsets]
|
v
[24.5 Granularity]
|
v
[24.6 Gaps]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) build a timeline from multiple sources; (2) normalise time zones; (3) recognise ordering errors; (4) present a timeline with its limits.
24.1 Why timelines
Timelines are a core forensic method: putting events from browsers, file systems and logs in one order shows sequences that no single source reveals.
A browser history alone shows a download, and a file system alone shows a file creation. Together, with a process start from the same folder thirty seconds later, they suggest that a downloaded file was run. Each source supports the others. Timelines also expose contradictions, such as a file apparently opened before it was created, which point to clock problems or tampering.
24.2 Normalisation
Sources record times in different zones and formats. Converting all to UTC before sorting is essential. Sorting raw local times from different zones gives wrong orders.
Formats differ too: Unix seconds, Windows FILETIME, ISO strings with offsets and local strings without them. A normaliser converts each to UTC and keeps the original value beside it. Where the zone is unknown, the event is flagged rather than guessed. A single unflagged guess can move an event across a key boundary, such as before or after a user logged off.
Lab — merging sources into a UTC timeline
"""Merge synthetic events from three sources into one UTC timeline."""
from datetime import datetime, timedelta, timezone
ev = [("browser", "2026-03-02T14:05:00-05:00", "download invoice.zip"),
("filesys", "2026-03-02T19:05:40+00:00", "invoice.zip created"),
("eventlog", "2026-03-02T20:06:10+01:00", "process started from Downloads"),
("filesys", "2026-03-02T19:20:00+00:00", "invoice.zip deleted")]
rows = sorted((datetime.fromisoformat(t).astimezone(timezone.utc), s, d) for s, t, d in ev)
for t, s, d in rows:
print(t.strftime("%H:%M:%S"), f"{s:9}", d)
Run with python3 lab_timeline.py. Verified output:
19:05:00 browser download invoice.zip
19:05:40 filesys invoice.zip created
19:06:10 eventlog process started from Downloads
19:20:00 filesys invoice.zip deleted
24.3 Reading the result
Three sources record times in UTC−5, UTC and UTC+1. Normalised to UTC, the order is: download at 19:05:00, file created at 19:05:40, process started from Downloads at 19:06:10, file deleted at 19:20:00. Sorted by the raw clock text instead, the browser event (14:05) would appear hours before the rest and the event-log entry (20:06) after the deletion — a false sequence.
The correct order shows a plausible sequence: download, file written to disk forty seconds later, program started thirty seconds after that, and the file deleted fourteen minutes on. The raw-text order would separate the download from its consequences by hours, inviting a false conclusion that the two were unrelated. Priya's exercise asks students to state which zone each source used before sorting.
24.4 Clock offsets
Each device may run fast or slow. If a reference event appears in two sources, its difference gives an offset to apply, documented with its basis.
A good reference event appears in both sources and happens at essentially one instant, such as a logon recorded by the workstation and by the domain controller. If several such events give consistent differences, the offset is reliable. If they disagree, the clock may have drifted or been adjusted, and the report explains that the offset varies rather than applying a single correction.
24.5 Granularity
Some timestamps have second resolution, others 100-nanosecond. Events within a source's resolution cannot be ordered with confidence.
FAT file systems store some timestamps to two-second resolution and some dates without times at all. If two events fall in the same two-second window, their order cannot be established from those stamps. Priya's timeline shows such events with a shared bracket rather than an invented sequence, and the report says the order is unresolved at that resolution. Higher-resolution sources can sometimes settle the order.
24.6 Gaps
Missing periods may mean nothing happened, logs rotated, or the device was off. Report gaps as gaps.
To tell these apart, Priya checks other sources: power-on and shutdown events, the oldest entries in each rotated log and the activity of other devices at the same time. A gap where the event log shows a clean shutdown means something different from one where the log simply starts later. The timeline marks each gap with its likely cause and how confident that judgement is.
24.7 Presentation
A table with source, time (UTC), event and artefact location lets readers verify each row.
Each row's artefact location is precise, such as a file path within the image, a registry key and value, or a log file with a record number, so a reviewer can open the source and confirm the entry. Rows are numbered for reference in the report text. A summary chart can accompany the table, but the table remains the authoritative version. Times keep the precision of their source.
Tool support
Validated timeline tools parse many artefact types; Priya's script only illustrates the principle. Examiners still check a sample of rows against the source artefacts.
Worked example
Priya's timeline shows a 40-second interval between download and file creation, consistent with a download completing. She notes that the process start 30 seconds later is consistent with the user opening the file, but the timeline alone does not show who did so.
Synthetic case. Events come from the lab script.
Errors and limits
A timeline orders recorded events; unrecorded actions are invisible, and clock errors propagate.
Exercises
- EX070 — Lab order. Give the UTC order of the four events. Rubric: 3 = download, created, process, deleted with times; 2 = order only; 1 = wrong; 0 = none.
- EX071 — Raw sort error. What goes wrong if raw local times are sorted? Rubric: 3 = zones mix, false sequence (e.g. process after deletion); 2 = partial; 1 = vague; 0 = none.
- EX072 — Gap meaning. Give three meanings of a timeline gap. Rubric: 3 = no activity, rotation, device off; 2 = two; 1 = one; 0 = none.
Synthesis
Normalise, offset, respect resolution and gaps, and present every row with its source.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →