An incident timeline depends on events being placed in the right order. If systems use different clocks, time zones, or timestamp formats, an action can appear to happen before its cause. Good timekeeping makes records easier to compare and conclusions easier to defend.
Understand the idea
Record both the time an event occurred and, where available, the time it was collected. Note the source time zone and any known clock difference. Use a consistent reference when building a timeline, while keeping original records unchanged so another reviewer can check the conversion.
- Time
Identify event time, collection time, and time-zone context.
- Offset
Check clock differences and known delays.
- Sequence
State what the evidence can—and cannot—establish.
A practical example
Imagine an email gateway and a laptop recording the same test event several minutes apart. The analyst checks their clock settings and collection delays before claiming that the laptop acted first. The timeline includes the known uncertainty rather than silently moving timestamps to fit a theory.
What to do next
- Record each source's time zone, synchronization configuration, and observed clock error.
- Preserve the original export and timestamp fields.
- Convert a working copy to a common reference such as UTC, retaining the original value and transformation.
- Use correlation identifiers, transaction references, and process relationships alongside time.
- Mark estimated ordering and uncertainty explicitly when the evidence cannot establish a strict sequence.
How to check the result
Create a harmless known event and compare its records across important systems. Document any difference and check time synchronization again after a configuration or hosting change.
A file export appears before the sign-in that should explain it.
Check the timestamps and collection path before inferring a second attacker or bypass. Record any adjustment and preserve the original values.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
