Category: Digital Forensics
Tags: timeline, forensics, dfir, super-timeline, plaso
Every forensic investigation eventually arrives at the same question: what happened, and in what order? Individual artifacts -- a registry key here, a prefetch file there, an event log entry somewhere else -- are evidence fragments. A timeline is the narrative that connects them. Without it, forensics is just a collection of interesting but disconnected facts, which is approximately as useful as a jigsaw puzzle stored in multiple different boxes.
This article covers the practical workflow for building forensic timelines -- from understanding NTFS timestamps through creating super timelines with Plaso, detecting timestamp manipulation, and the methodology for pivoting through thousands of events to reconstruct an incident.
Why Timelines Matter
A single artifact proves that something happened. A timeline proves that things happened in a specific sequence -- and sequence is everything in incident response.
Consider: a Prefetch file proves mimikatz.exe ran. An event log shows a Type 10 (RDP) logon. An MFT entry shows a new file in C:\Windows\Temp\. Individually, these are data points. Arranged chronologically, they tell the story: the attacker logged in via RDP at 14:23, dropped a tool at 14:24, and executed it at 14:25. The timeline turns scattered artifacts into an incident narrative.
NTFS Timestamps -- MACB
NTFS stores two sets of timestamps for every file -- and understanding the difference is critical for forensic analysis and detecting anti-forensics.
$STANDARD_INFORMATION vs $FILE_NAME
| Attribute | Modified By | Forensic Role |
|---|---|---|
| $STANDARD_INFORMATION (SI) | Updated by normal file operations AND modifiable by user-level APIs | What the OS and applications "see" -- can be manipulated |
| $FILE_NAME (FN) | Updated only by the kernel | Ground truth -- extremely difficult to modify |
MACB Behaviour Reference
| Operation | SI Modified | SI Accessed | SI Changed | SI Created | FN Updated |
|---|---|---|---|---|---|
| File Create | Set | Set | Set | Set | All four set |
| File Modify | Updated | Updated | Updated | -- | -- |
| File Read | -- | Updated | -- | -- | -- |
| File Rename | -- | -- | Updated | -- | -- |
| File Copy (new) | -- | -- | Set | Set (now) | All four set |
| Permission Change | -- | -- | Updated | -- | -- |
The Lateral Movement Timestamp Pattern
When a file is copied to a target via SMB (the attacker pushing malware via net use and copy):
SI Created = time of copy (new file on destination)
SI Modified = original modification time (preserved from source)
FN Created = time of copy
Key indicator: SI Modified < SI CreatedA file whose content timestamp predates its creation on this system was copied from somewhere else. This pattern is one of the most reliable indicators of lateral movement.
Building a Super Timeline with Plaso
Plaso (log2timeline) is the gold standard for automated super timeline creation. It parses dozens of artifact types into a single, sortable timeline.
Collection
# Full disk image to super timeline
log2timeline.py --storage-file timeline.plaso disk_image.E01
# Specific parsers only (significantly faster)
log2timeline.py --parsers "winevtx,prefetch,mft,usnjrnl,lnk,recycle_bin,sam,amcache" \
--storage-file timeline.plaso disk_image.E01
# KAPE/triage collection (no full disk image needed)
log2timeline.py --storage-file timeline.plaso /path/to/triage-output/
# Windows event logs only
log2timeline.py --parsers winevtx --storage-file evtx.plaso /path/to/winevtx/Filtering and Output
# Full CSV output
psort.py -o l2tcsv -w timeline.csv timeline.plaso
# Filter by date range
psort.py -o l2tcsv -w timeline.csv timeline.plaso \
"date > '2024-01-15 00:00:00' AND date < '2024-01-20 00:00:00'"
# Filter by source type
psort.py -o l2tcsv -w timeline.csv timeline.plaso "source_short == 'EVT'"
# Time slice -- show events within 5 minutes of a pivot point
psort.py --slice '2024-01-15T14:30:00' -w slice.csv timeline.plaso
# Output formats
psort.py -o json_line -w timeline.jsonl timeline.plaso # JSON lines
psort.py -o xlsx -w timeline.xlsx timeline.plaso # Excel (small datasets only)
psort.py -o elastic timeline.plaso --server 127.0.0.1 --port 9200 --index_name case001Key Plaso Parsers
| Parser | What It Processes |
|---|---|
winevtx |
Windows XML event logs (.evtx) |
prefetch |
Windows Prefetch files |
mft |
NTFS $MFT |
usnjrnl |
NTFS USN Change Journal ($J) |
lnk |
Windows shortcut files |
recycle_bin |
Recycle Bin ($I/$R files) |
amcache |
Amcache.hve registry |
sam |
SAM registry hive |
pe |
PE file metadata (compilation timestamps) |
olecf_* |
OLE Compound Files (Office documents, Jump Lists) |
MFT Analysis
The Master File Table is the filesystem's ledger -- every file and directory on an NTFS volume has an MFT entry with creation, modification, access, and change timestamps.
Parsing with MFTECmd
MFTECmd.exe -f $MFT --csv output/ --csvf mft.csv
MFTECmd.exe -f $MFT --body output/mft_body.txt --bodyf mft_bodyKey columns in the output: Created0x10, Modified0x10 (SI timestamps) vs Created0x30, Modified0x30 (FN timestamps). Comparing these two sets is how you detect timestomping.
USN Journal
The USN Journal ($UsnJrnl:$J) records every file system change -- creates, deletes, renames, data overwrites.
MFTECmd.exe -f $J --csv output/ --csvf usn.csvFilter for FileCreate near the incident window to find dropped files, RenameOldName/RenameNewName for staging and cleanup activity, and DataOverwrite on system files for evidence of tampering.
Timestomping Detection
Timestomping -- modifying file timestamps to blend malicious files with legitimate system files -- is one of the most common anti-forensic techniques. It is also one of the most detectable, provided you know where to look.
Detection Rules
| Rule | What It Means |
|---|---|
| SI Created < FN Created | SI timestamp was backdated -- definitive timestomping |
| SI Modified < FN Created | Content timestamp predates file existence -- timestomped |
| Created > Modified | Impossible without manipulation |
| SI timestamps at exact midnight | Suspicious -- real files rarely have perfectly round timestamps |
| Sub-second precision mismatch between SI and FN | Tool left traces in timestamp precision |
The principle is simple: $FILE_NAME timestamps are set by the kernel and cannot be modified by standard APIs. $STANDARD_INFORMATION timestamps can be modified by tools like SetFileTime(). When SI claims the file was created in 2019 but FN says it was created yesterday, someone is lying -- and it is not the kernel.
Event Log Timeline
Windows event logs are the single richest timeline source for authentication, process execution, and lateral movement.
Critical Event IDs
Authentication:
4624 Successful logon (check Type: 2=Interactive, 3=Network, 10=RDP)
4625 Failed logon (brute force indicator)
4648 Explicit credential logon (RunAs, PsExec)
4672 Admin logon (special privileges assigned)
Process Execution:
Sysmon 1 Process creation (command line, hashes, parent)
4688 Process creation (enable command line auditing)
Persistence:
7045 New service installed
4698 Scheduled task created
Sysmon 12/13/14 Registry modifications
Defence Evasion:
1102 Security audit log cleared
104 System log cleared
4719 Audit policy changedParsing with EvtxECmd
EvtxECmd.exe -d C:\Windows\System32\winevt\Logs\ --csv output/ --csvf all_events.csvThe Analysis Methodology
A ten-step methodology for timeline analysis, from scoping through reporting:
- SCOPE -- define the incident timeframe from the initial alert or indicator
- COLLECT -- gather all artifact sources (MFT, event logs, prefetch, registry, USN journal)
- PARSE -- process each source with appropriate tools (MFTECmd, EvtxECmd, PECmd, log2timeline)
- NORMALISE -- convert all timestamps to UTC (this step is not optional)
- MERGE -- combine into a single sortable timeline
- PIVOT -- start from the known-bad event and expand outward
- CORRELATE -- link events across sources (e.g., 4624 logon -> prefetch -> MFT file creation -> 7045 service)
- GAPS -- identify missing time periods (log clearing? check Event IDs 1102/104)
- DOCUMENT -- annotate the timeline with findings
- REPORT -- extract key events for the incident narrative
- Windows Forensics 101: The Registry -- the artifacts that feed into your timeline
- Windows Forensics 102: Execution Artifacts -- Prefetch, Amcache, and ShimCache in depth
- Windows Forensics 104: Event Logs -- the event IDs that populate your timeline
- Incident Response 102: Evidence Preservation -- collecting the data before you can timeline it
Pivot Points
A pivot point is a known event that anchors the analysis. Start with what you know -- an alert timestamp, a known-malware execution time, an anomalous logon -- and expand outward.
From the initial pivot, examine:
+/- 5 minutes: What else happened? File creates, process starts, logons
+/- 1 hour: Context -- was this part of a larger activity sequence?
Backward: How did the attacker arrive? (initial access, lateral movement)
Forward: What did they do next? (post-exploitation, exfiltration)High-Value Directory Filters
When the timeline is overwhelming (and super timelines routinely contain millions of entries), filter by directories where attackers operate:
| Path | Why |
|---|---|
C:\Windows\Temp\ |
Common tool staging area |
C:\Users\*\AppData\Local\Temp\ |
Per-user temp -- payload execution |
C:\Users\*\Downloads\ |
Initial payload delivery |
C:\ProgramData\ |
Attacker staging area (writable, often overlooked) |
C:\Windows\Prefetch\ |
Attackers sometimes delete prefetch to cover tracks |
C:\Windows\System32\Tasks\ |
Scheduled task persistence |
Tools Summary
| Tool | Purpose |
|---|---|
| Plaso / log2timeline | Automated super timeline creation from disk images |
| psort | Filter and output Plaso timelines |
| MFTECmd | Parse $MFT and USN Journal |
| EvtxECmd | Parse Windows event logs |
| PECmd | Parse Prefetch files |
| AmcacheParser | Parse Amcache.hve |
| AppCompatCacheParser | Parse ShimCache from SYSTEM hive |
| Timeline Explorer | GUI for analysing parsed CSV timelines |
| SOF-ELK | Elasticsearch/Kibana VM for timeline visualisation |
All the parsers above are from Eric Zimmerman's tool suite and follow the same CSV output convention, making them straightforward to combine. Timeline Explorer, also from Zimmerman, handles the resulting CSV files with colour-coding and filtering that makes million-row timelines navigable.
