Building a Timeline

You have recovered files, a memory dump, and a pcap. Each one is a pile of facts with no story. The story is the order things happened in, and you get it by putting every timestamped artifact onto one clock and reading top to bottom. That merged view is a timeline, and it is where isolated findings become "the attacker landed here, escalated there, and left with this".

One clock, every source

A single event leaves marks in a dozen places. A malicious binary running touches its file access time on disk, writes a prefetch entry, appears in the memory dump's process list, opens a socket that shows in the pcap, and drops a line in a log. Alone, each is a hint. Lined up on the same clock, they corroborate each other and pin the event to a second.

The artifacts you feed a timeline: file system MAC times, Windows Event Logs, $MFT and registry hives, browser history, bash_history, prefetch, and the timestamps you already pulled from memory and network captures. The more independent sources agree on a moment, the harder that moment is to dispute.

Build a super timeline with plaso

Correlating this by hand does not scale. Plaso (the log2timeline project) parses dozens of artifact types out of a disk image and emits one unified, sorted timeline, often called a super timeline. You run two tools: log2timeline.py to extract, then psort.py to filter and format.

The first run produces thousands of events, which is unreadable. The skill is narrowing. Find your pivot (the moment the alert fired, the first bad connection in the pcap) and slice a tight window around it. Everything the attacker did clusters near that pivot, so a two-hour slice usually holds the whole intrusion.

Timestamps lie, so cross-check them

A timeline is only as trustworthy as its clocks, and clocks are messy. Three traps catch people constantly.

Time zones first. File systems record different times in different zones: NTFS stores UTC, FAT stores local time. Mix them without normalizing and events land minutes or hours out of order. Always convert everything to UTC before you reason about sequence.

Second, clock skew. The suspect machine, the firewall that made the pcap, and your workstation may each be a few seconds off. Note the offset for every source so a five-second gap does not read as a real delay.

Third, timestomping. Attackers deliberately alter MAC times to hide, and tools like the Metasploit timestomp command make it trivial. The tell is that the $STANDARD_INFORMATION timestamps get faked but the $FILE_NAME timestamps in the MFT usually do not. When the two disagree for a file, someone was covering tracks, and that disagreement is itself evidence.