Digital › Module 7 › Lesson 1
Timeline Named
Timeline literacy — UTC normalization, artifact types, and event rows from $DFIR_LAB practice evidence.
Visual · t26_timeline_named
Timeline = UTC-ordered artifact rows. $DFIR_LAB. Original Cyberlium.
Opening
A case without a UTC timeline is guesswork — build yours from authorized lab evidence, not from fiction.
Timeline literacy names row fields: UTC timestamp, source (PCAP, Event log, filesystem MAC, registry, memory), artifact ID, action/description, observed vs inferred, analyst notes. Normalize all sources to UTC with documented clock skew assumptions on $DFIR_LAB practice images. Tools at literacy level: spreadsheet, Plaso/log2timeline concept, suite timeline view — NOT deleting contradictory rows, NOT backdating events, NOT building timelines from stranger device dumps without legal authority. Chain of custody on every exported row set. Module 6 net/logs rows feed timeline station. Lab deliverable: ten-row minimum skeleton with integrity footer.
1. Timeline row schema
UTC time, source, artifact, description, observed/inferred, hash reference — six columns minimum.
Gaps labeled honestly — missing logs are findings, not excuses to invent events.
Command guide
Try these commands — Timeline row schema
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Timeline analysis — https://www.sans.org/cyber-security-skills/digital-forensics/ (super timeline literacy) Sleuth Kit mactime — https://www.sleuthkit.org/sleuthkit/man/mactime.html (MAC time context) Autopsy timeline — https://www.autopsy.com/ (GUI timeline module literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
python3 - <<'PY'
import csv, os
lab = os.environ.get('LAB_DFIR', os.path.expanduser('~/cyberlium-lab/t26-dfir'))
path = os.path.join(lab, 'notes', 'timeline.csv')
rows = [
['timestamp', 'source', 'event', 'artifact'],
['2026-08-22T02:00:00Z', 'sample.txt', 'file_created', 'evidence/sample.txt'],
['2026-08-22T02:01:00Z', 'fake-log', 'auth_failure', 'notes/fake-log-lines.txt:1'],
['2026-08-22T02:01:10Z', 'fake-log', 'sudo_command', 'notes/fake-log-lines.txt:3'],
['2026-08-22T02:02:00Z', 'pcap', 'lo_capture', 'pcap/lo-lab.pcap'],
]
with open(path, 'w', newline='') as f: csv.writer(f).writerows(rows)
print(f'Wrote {path}')
PYCommand — copy this
head -6 "$LAB_DFIR/notes/timeline.csv"
Primary tools to practice this lesson: python3, grep. Reference sites: Timeline analysis (https://www.sans.org/cyber-security-skills/digital-forensics/); Sleuth Kit mactime (https://www.sleuthkit.org/sleuthkit/man/mactime.html); Autopsy timeline (https://www.autopsy.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. UTC discipline
Document timezone of each source; convert with tool or noted offset — never silent local-time mix.
Module 1 CoC: timeline export gets hash and version row.
3. Scope refuse
No timelines built from unauthorized acquisitions — $DFIR_LAB and brief-assigned practice only.
Refused: fabricating events, planting files to fit narrative.
4. What you ship: timeline row schema card
Six column definitions + UTC rule + ten-row skeleton template + no-fabrication line.
5. What you record before the next lesson
Timeline row schema card path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Insert fake logon event to make timeline 'more interesting.'
Right
Timeline row schema for $DFIR_LAB practice case. Next: Correlation.
Mission: timeline row schema card
1) Define six timeline columns. 2) Write UTC normalization rule. 3) Draft three skeleton rows from Module 6 lab. 4) Write NEVER fabricate events line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Clock skew — document how?”
Knowledge Check
APPLY: Timeline rows require:
Multiple choice
Knowledge Check
APPLY: True or False: Backdating timeline events is lab.
True or False
Knowledge Check
APPLY: Timeline gaps should:
Multiple choice