NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Timeline Analysis Fundamentals
Master timeline analysis fundamentals. Learn to extract, normalize, and merge disparate forensic artifacts into a unified chronological narrative.
Room tasks
1What Is Timeline Analysis and Why Does It Matter
2Timestamp Types (MACB) and Timestomping
3Building a Super Timeline with log2timeline/Plaso
4Guided Lab: Constructing a Timeline from Disk Image Artifacts
Frequently Asked Questions
What is a forensic timeline?
A forensic timeline orders events from many artifacts by time to show what happened and when. It helps investigators see the sequence of an intrusion and spot activity around key moments.
What is a super timeline?
A super timeline merges timestamps from file systems, logs, registry and browser data into one dataset, often built with Plaso. It gives a broad view but needs filtering to be useful.
Why normalise timestamps?
Sources use different time zones and formats, so mixing them causes false conclusions. Converting to a common standard such as UTC keeps the timeline accurate. This Codelivly room is free and covers it hands-on.