Page 1

DIGITAL TIMELINE S · A GUIDE FOR UK LAWYERS Building a Digital Timeline for Litigation From Scattered Timestamps to a Chronology the Court Can Trust COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE TIMELINE CONSTRUCTION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: sequence is the case, and clocks lie politely 03 The raw material: event sources across the estate 04 Normalisation: time zones, clock drift and field semantics 05 Corroboration and confidence: making each line defensible 06 Construction in practice: from artefacts to the master timeline 07 Presentation and deployment: chronologies that persuade and survive 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ALITIGATIONTIMELINEISBUILT, NOTCOMPILED: EVENTSFROM INDEPENDENTSOURCES, ONETEMPORALFRAME, CORROBORATIONPERLINE, CONFIDENCESTATED: SOTHECHRONOLOGYISEVIDENCETHEOTHERSIDEMUST ANSWER, NOTARGUMENTTHEYCANDISMISS

§ 02 · FIRST PRINCIPLES The problem in plain English: sequence is the case, and clocks lie politely

§ 03 · THERAWMATERIAL The raw material: event sources across the estate