# Timeline Analysis Fundamentals

> Master timeline analysis fundamentals. Learn to extract, normalize, and merge disparate forensic artifacts into a unified chronological narrative.

Canonical: https://codelivly.com/rooms/timeline-analysis-fundamentals
Last updated: 2026-09-17

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This foundational module introduces the core principles of timeline analysis in Digital Forensics and Incident Response (DFIR). You will learn how to extract timestamps from diverse sources (file systems, registry hives, event logs), normalize them to a single timezone, and merge them into a comprehensive "super timeline." By mastering these fundamentals, you will be equipped to reconstruct the exact sequence of attacker actions, identify hidden attack chains, and build legally defensible, chronological incident reports.

## Lessons

1. What Is Timeline Analysis and Why Does It Matter (30 min)
2. Timestamp Types (MACB) and Timestomping (30 min)
3. Building a Super Timeline with log2timeline/Plaso (30 min)
4. Guided Lab: Constructing a Timeline from Disk Image Artifacts (30 min)

## Related

- [Learning path: Timeline Analysis and Artifact Correlation](https://codelivly.com/learning-paths/timeline-analysis-and-artifact-correlation)
- [All rooms](https://codelivly.com/rooms)