Lab — Timeline

Timeline lab on $DFIR_LAB — UTC timeline, correlation rows, hypotheses with falsification tests.

Lab — Timeline• Audio Walkthrough

00:00/02:46

Visual · t26_timeline_lab

Lab: timeline pack on YOUR $DFIR_LAB practice case. Original Cyberlium.

Ship a ten-row UTC timeline with three correlations and three hypotheses — all sourced, none fabricated.

On YOUR $DFIR_LAB per brief: (1) case proof — hashes, CoC reference from Module 1; (2) timeline ≥10 UTC rows spanning net/logs/disk/memory as available; (3) ≥3 correlation rows with join keys and confidence; (4) ≥3 hypotheses with falsification tests; (5) gap paragraph for missing logs; (6) integrity — no fabrication, no unauthorized evidence, no deleted contradicting rows; (7) chmod 600 pack. Cross-link Module 6 net/logs lab artifact IDs. Optional: export CSV with hash in footer. Revert snapshot after if brief requires.

1. Deliverables

Timeline + correlation + hypotheses index — cross-linked.

Gap paragraph mandatory when sources incomplete.

Command guide

Try these commands — Deliverables

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Super timeline — https://www.sans.org/cyber-security-skills/digital-forensics/ Sleuth Kit — https://www.sleuthkit.org/sleuthkit/man/mactime.html CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response

═══ INSTALL ═══

Linux (Debian/Ubuntu):

macOS:

Windows:

═══ LINUX / macOS ═══

Command — copy this

export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat >> "$LAB_DFIR/notes/timeline.csv" <<'EOF'
2026-08-22T02:03:00Z,hash_verify,sample_bin_integrity,evidence/sample.bin.sha256
EOF

Command — copy this

grep sample_bin "$LAB_DFIR/notes/timeline.csv"
sha256sum -c "$LAB_DFIR/evidence/sample.bin.sha256" 2>/dev/null && grep sample_bin "$LAB_DFIR/notes/timeline.csv"

Primary tools to practice this lesson: grep, sha256sum. Reference sites: Super timeline (https://www.sans.org/cyber-security-skills/digital-forensics/); Sleuth Kit (https://www.sleuthkit.org/sleuthkit/man/mactime.html); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.