Computer Forensics Lab, e-discovery.uk
e‑discovery.uk
Computer Forensics Lab eDiscovery
§ Guide

Building A Digital Timeline For Litigation

This guide, 'Building a Digital Timeline for Litigation', is for UK lawyers, in-house counsel, and investigators.

Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active

Guide · 17 pages · 21 min read · Published 2026-08-30

This guide, 'Building a Digital Timeline for Litigation', is for UK lawyers, in-house counsel, and investigators. It addresses the challenge of constructing a reliable chronology from scattered timestamps and event sources across an estate. The guide covers normalisation of time zones and clock drift, corroboration for defensible lines, and practical construction from artefacts to a master timeline. It also details presentation for court, source architecture, common mistakes, technical limitations, and questions to ask. Key topics include understanding why a litigation timeline is built, not compiled, and how to achieve a chronology the court can trust, where sequence is the case and clocks can 'lie politely'. It explains when to involve a digital forensic expert and how a specialist laboratory can assist.

Share
LinkedIn X / Twitter WhatsApp Email

Read this guide on your phone, browse guides by topic or go back to the full PDF library.

§ Credit and source

Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. See every guide's author and source.

§ Full text of Building A Digital Timeline For Litigation

Download the PDF

Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.

Page 1

DIGITAL TIMELINE S · A GUIDE FOR UK LAWYERS Building a Digital Timeline for Litigation From Scattered Timestamps to a Chronology the Court Can Trust COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE TIMELINE CONSTRUCTION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: sequence is the case, and clocks lie politely 03 The raw material: event sources across the estate 04 Normalisation: time zones, clock drift and field semantics 05 Corroboration and confidence: making each line defensible 06 Construction in practice: from artefacts to the master timeline 07 Presentation and deployment: chronologies that persuade and survive 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ALITIGATIONTIMELINEISBUILT, NOTCOMPILED: EVENTSFROM INDEPENDENTSOURCES, ONETEMPORALFRAME, CORROBORATIONPERLINE, CONFIDENCESTATED: SOTHECHRONOLOGYISEVIDENCETHEOTHERSIDEMUST ANSWER, NOTARGUMENTTHEYCANDISMISS

§ 02 · FIRST PRINCIPLES The problem in plain English: sequence is the case, and clocks lie politely

§ 03 · THERAWMATERIAL The raw material: event sources across the estate

Page 2

§ 04 · ONECLOCK Normalisation: time zones, clock drift and field semantics

§ 05 · THEWEIGHTOFEACHLINE Corroboration and confidence: making each line defensible

§ 06 · THEBUILD Construction in practice: from artefacts to the master timeline

§ 07 · INCOURT ' SHANDS Presentation and deployment: chronologies that persuade and survive

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVENT DEVICE PLATFORM COUNTERPART NETWORK DELETED/ T YPE ARTEFACTS AUDIT LOGS RECORDS LAYER RECOVERABLE PHYSICAL- WORLD SYSTEMS

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THETRADE, THEBRIEFINGANDTHEFORTYMINUTES EXAMPLE2 · THEEXITTHATWASCHOREOGRAPHED EXAMPLE3 · THECHRONOLOGYTHATFELLTOITSOWNSPREADSHEET

Page 3

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORTIMELINECONSTRUCTION

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The timeline checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions Why can't we just build the chronology from the documents' visible dates? What does "normalising to UTC" actually involve? How precise are digital timestamps really? The other side's chronology contradicts ours. How is that resolved? Can a timeline prove who did something, or only when it happened? When should timeline work start?

§ 14 · REFERENCE Glossary UTC Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY

§ Common questions

Frequently asked questions

Why can't we just build the chronology from the documents' visible dates?
Because visible dates mix zones, semantics and drifting clocks: Example 3's spreadsheet did exactly that and fell to its own lines: and because a chronology without artefact provenance cannot answer the first challenge put to it. Compilation makes a working draft; construction (§4-§6) makes evidence.
What does "normalising to UTC" actually involve?
Establishing each source's storage convention, converting every event to one UTC base, then presenting in relevant local time with the rule stated: plus drift calibration and DST checks: §4's procedure. It is bookkeeping, not magic: the point is that after it, any two events can be legitimately compared: and before it, none can.
How precise are digital timestamps really?
As precise as their clock and resolution: synced server logs are excellent to the second; device fields are good when the clock was; free-running DVRs are only as good as their calibration; some sources resolve only to minutes or days: which is why §5 grades confidence and §10 claims orderings only at supported resolution. Precision is per-source, established, never assumed.
The other side's chronology contradicts ours. How is that resolved?
By methodology: the frames, semantics, calibrations and provenance of both are compared, conflicts diagnosed to their cause (zone error, drift, field mix-up, or a genuinely contested stamp needing guide 108-109 treatment): Examples 1 and 3 are both stories of one chronology surviving that audit and one not. Courts follow the timeline that shows its working.
Can a timeline prove who did something, or only when it happened?
The timeline orders events attributed to accounts and devices; attribution to fingers is the separate discipline of guides 105-107, and the two are built together where identity is contested: Example 2's badge, CCTV and device layers doing exactly that join. Sequence plus attribution is the full product; the timeline alone is the when.
When should timeline work start?
With the case: the best clocks (platform audit logs) sit on rolling retention that deletes them while pleadings are exchanged (§10), and the critical path defined early lets preservation and collection target its sources: guide 95's windows apply to time evidence with full force. A timeline started at trial preparation is built from what survived; one started at instruction is built from what existed. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

Open a confidential matter→+44 (0)20 7164 6971Direct lineinfo@e-discovery.ukEncrypted
WhatsApp