Digital › Module 7 › Lesson 4
Lab — Timeline
Timeline lab on $DFIR_LAB — UTC timeline, correlation rows, hypotheses with falsification tests.
Visual · t26_timeline_lab
Lab: timeline pack on YOUR $DFIR_LAB practice case. Original Cyberlium.
Opening
Ship a ten-row UTC timeline with three correlations and three hypotheses — all sourced, none fabricated.
On YOUR $DFIR_LAB per brief: (1) case proof — hashes, CoC reference from Module 1; (2) timeline ≥10 UTC rows spanning net/logs/disk/memory as available; (3) ≥3 correlation rows with join keys and confidence; (4) ≥3 hypotheses with falsification tests; (5) gap paragraph for missing logs; (6) integrity — no fabrication, no unauthorized evidence, no deleted contradicting rows; (7) chmod 600 pack. Cross-link Module 6 net/logs lab artifact IDs. Optional: export CSV with hash in footer. Revert snapshot after if brief requires.
1. Deliverables
Timeline + correlation + hypotheses index — cross-linked.
Gap paragraph mandatory when sources incomplete.
Command guide
Try these commands — Deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Super timeline — https://www.sans.org/cyber-security-skills/digital-forensics/ Sleuth Kit — https://www.sleuthkit.org/sleuthkit/man/mactime.html CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat >> "$LAB_DFIR/notes/timeline.csv" <<'EOF'
2026-08-22T02:03:00Z,hash_verify,sample_bin_integrity,evidence/sample.bin.sha256
EOFCommand — copy this
grep sample_bin "$LAB_DFIR/notes/timeline.csv" sha256sum -c "$LAB_DFIR/evidence/sample.bin.sha256" 2>/dev/null && grep sample_bin "$LAB_DFIR/notes/timeline.csv"
Primary tools to practice this lesson: grep, sha256sum. Reference sites: Super timeline (https://www.sans.org/cyber-security-skills/digital-forensics/); Sleuth Kit (https://www.sleuthkit.org/sleuthkit/man/mactime.html); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Every row cites artifact hash or log export ID — no orphan claims.
Confidence honest — weak joins stay weak.
3. Integrity
$DFIR_LAB only; observed/inferred/hypothesis columns or sections separate.
Share-safe export redacts PII — mentor pack chmod 600.
4. What you ship: timeline lab pack
Ten-row timeline + three correlations + three hypotheses + gaps + integrity — chmod 600.
5. What you record before the next lesson
Timeline lab pack path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Timeline lab includes fabricated events and deleted contradicting logs.
Right
Timeline lab pack on $DFIR_LAB. Next: quiz.
Mission: timeline lab
1) Ten UTC timeline rows. 2) Three correlation rows. 3) Three hypotheses with falsification. 4) Gap paragraph; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum row count if brief sparse?”
Knowledge Check
APPLY: Timeline lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Gaps can be hidden in timeline lab.
True or False
Knowledge Check
APPLY: Each timeline row should cite:
Multiple choice