OpenCyber AcademyDay 21 — Version a timeline around event time and knowledge time
Theory and mechanism. A timeline is a derived argument: it selects records, transforms time representations and states why entries matter. Its event ordering and its knowledge ordering answer different questions. Event time asks when the producer says something occurred; knowledge/receipt time asks when the analyst could use the supplied record. Retain source event, ingestion where known, case receipt/release, transformation and claim limit. A new version may incorporate later evidence, but the earlier decision must remain reconstructible. The NIST forensic-techniques guide supplies acquisition/analysis context; this versioned classroom table is an original teaching method.
Worked contrast. At 09:22, the investigator can record C05's reported 09:01 edit but cannot cite batch-17. C12 adds that tag at 09:26 as a read-only view of the same reported application request. Recording a second edit at 09:26 would confuse a new observation about an old event with a new source event. Conversely, backfilling the tag into the frozen 09:22 assessment would pretend the analyst knew it earlier. Use a supplement pointing to C05 and C12, not a rewritten raw C05 record.
C11 requires another distinction: 09:24 is when support provides the statement. The alleged addendum's existence, effective time and contents remain unspecified. A timeline row cannot use 09:24 as the approval time of an unprovided document. Preserve the quotation's uncertainty—“might have been included”—rather than changing it to “included.” C06's visible S40/S41 approval and C11's possible S42 addendum are separate records in tension, not an approval history the analyst is free to complete.
Lesson table; scroll horizontally to read all columns →
| New timeline information | Underlying event/claim time | Case knowledge time | Defensible annotation |
|---|---|---|---|
| C11 operator statement | Time of a purported addendum not supplied | 09:24 | Lead for change-authority verification; no addendum received |
| C12 application view | Supplements C05's 09:01 request q-144 |
09:26 | Self-reported tag observed in supplied view; no validated scheduler origin |
Assumptions and decision. Keep earlier uncertainty intact. C02's symptom was noticed around 09:00; C05 records an edit at 09:01. Do not move either time to make the edit appear causal. The apparent order may motivate questions about reporter precision, clocks, caching or an earlier event, but none is an observed explanation. A sorted table is not a causal test. Likewise C04's corrected 08:58 estimate and C10's conditional 09:21 conversion retain their distinct time-basis limitations.
Record the analysis revision, checkpoint and reason for each supplement. If the acquisition quality is unresolved, retain that qualifier with every derived use: C09's supplied session/client row remains informative while its source-object and byte-integrity fields remain missing. Missing metadata neither proves the row false nor authorizes calling it verified.
Practice and limit. Complete EX021 with the seven core source entries and explicit C11/C12 supplements, then show what a frozen 09:22 version excludes. Compare the worked answer. A traceable timeline exposes contradictions and release boundaries; it cannot establish actor, source authenticity or an unmeasured historical state.
Continue studying — course Day 21: Previous: Week 4, Day 20 · Week 5 index · Course index · Next: Day 22.
Exercise for this lesson
EX021 — Source-traceable timeline. Objective: reconstruct event and knowledge order without rewriting a checkpoint. Input: C02–C12 through 09:26 and Day 21. Produce at least seven core source entries with event time/range, raw/derived time, ingestion where supplied, case receipt/release, source ID and limitation; add explicit C11 and C12 supplements. C11's alleged addendum time remains unknown; C12 supplements C05's 09:01 event rather than adding a new edit. Identify what a frozen 09:22 version excludes. Rubric: 0 = future-card use, invented event/approval time or repaired chronology; 1 = source-linked timeline but missing uncertainty, supplements or version boundary; 2 = reproducible time annotations, both later supplements and intact earlier checkpoint. Worked answer.