Timelines and findings
🎯You'll be able to
Combine sources into one timeline, mark what is fact and what is inference, and write findings that others can check.
🏠The everyday picture
A cricket match report lists each ball and what happened, then the commentator gives an opinion on why the team lost. Readers can tell which is which.
📘What it really is
-
A forensic timeline merges events from several sources into one list, oldest first, in one time zone (UTC), with local time (IST) alongside.
-
Each row says the time, the source, the event and the evidence ID, so anyone can check it against the original.
- Clock differences: if one source's clock was off, note the offset and how it was worked out.
- Gaps: periods with no data are recorded as gaps, not assumed to be quiet.
-
Facts and inferences: "S04 logged in from 203.0.113.77 at 21:40 UTC" is a fact from the log. "The intruder guessed S04's password" is an inference from the failures before it. Label each.
-
Neutral language: describe accounts and addresses, not people, until identity is established. An account being used doesn't prove its owner used it.
-
Findings answer the questions asked: how did they get in, what did they access, when did it start and stop, is it over?
📝A worked example
Input: your Project 3 timeline for S04, plus the evidence IDs from Lesson 3.
Steps:
- Add a source and evidence ID column to each row.
- Mark the inference rows, for example "password likely guessed (inferred from 7 failures in 4 minutes before the success)".
- Write four findings: way in, records accessed, start and end, and current status.
Expected output: a timeline with facts and inferences labelled, and a half-page of findings that refer to evidence IDs.
🌍Where it's used
- Incident reports for owners, insurers and regulators.
- Court and tribunal submissions, where every claim must trace to evidence.
- Internal reviews, where neutral language keeps the investigation fair.
📝Case scenario
An internal report said "the accountant stole the files". Logs only showed the accountant's account was used, from a shared office computer, while the accountant was on leave. The final report was rewritten to say what the evidence showed, and the investigation then found a colleague who knew the password.
🖱️Try it
Rewrite this sentence neutrally: "The receptionist leaked patient data at 3 a.m." Success: your version describes an account, an address and a time, and doesn't assume who was at the keyboard.
⚠️Common mistakes
- Mixing time zones. Sign: unlabelled times. Fix: UTC with IST alongside.
- Inference written as fact. Sign: "the attacker did X" with no basis shown. Fix: label inferences and their basis.
- Naming people too early. Sign: a person's name where the log shows an account. Fix: describe the account.
🛠️For your project
Test 8 in Project 3 checks your timeline's UTC and IST columns. The capstone builds on it with sources, evidence IDs and labelled inferences.
✅Quick check
What's the difference between a fact and an inference in a timeline?
Show the answer
A fact comes directly from evidence; an inference is a conclusion drawn from it, and is labelled with its basis.
Why describe accounts rather than people?
Show the answer
An account being used doesn't prove its owner was the one using it.