Building A Digital Timeline For Litigation

DIGITALTIMELINES · AGUIDEFORUKLAWYERS Building a Digital Timeline for Litigation From Scattered Timestamps to a Chronology the Court Can Trust COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE TIMELINE CONSTRUCTION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: sequence is the case, and clocks lie politely 03 The raw material: event sources across the estate 04 Normalisation: time zones, clock drift and field semantics 05 Corroboration and confidence: making each line defensible 06 Construction in practice: from artefacts to the master timeline 07 Presentation and deployment: chronologies that persuade and survive 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ALITIGATIONTIMELINEISBUILT , NOTCOMPILED : EVENTSFROM INDEPENDENTSOURCES , ONETEMPORALFRAME , CORROBORATIONPERLINE , CONFIDENCESTATED : SOTHECHRONOLOGYISEVIDENCETHEOTHERSIDEMUST ANSWER , NOTARGUMENTTHEYCANDISMISS § 0 2 · FIRSTPRINCIPLES The problem in plain English: sequence is the case, and clocks lie politely § 0 3 · THERAWMATERIAL The raw material: event sources across the estate § 0 4 · ONECLOCK Normalisation: time zones, clock drift and field semantics § 0 5 · THEWEIGHTOFEACHLINE Corroboration and confidence: making each line defensible § 0 6 · THEBUILD Construction in practice: from artefacts to the master timeline § 0 7 · INCOURT ' SHANDS Presentation and deployment: chronologies that persuade and survive § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVENT DEVICE PLATFORM COUNTERPART NETWORK DELETED/ T YPE ARTEFACTS AUDIT LOGS RECORDS LAYER RECOVERABLE PHYSICAL- WORLD SYSTEMS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THETRADE , THEBRIEFINGANDTHEFORTYMINUTES EXAMPLE2 · THEEXITTHATWASCHOREOGRAPHED EXAMPLE3 · THECHRONOLOGYTHATFELLTOITSOWNSPREADSHEET § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORTIMELINECONSTRUCTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The timeline checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Why can't we just build the chronology from the documents' visible dates? What does "normalising to UTC" actually involve? How precise are digital timestamps really? The other side's chronology contradicts ours. How is that resolved? Can a timeline prove who did something, or only when it happened? When should timeline work start? § 1 4 · REFERENCE Glossary UTC Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY