Ask three responders what happened and you get three stories. A timeline turns stories into a table where every row cites an artifact.
Normalize time before anything else
- Work in UTC. Record every row as ISO 8601 in UTC and say so in the header. Mixed local times with unstated daylight saving is the most common way a timeline ends up quietly wrong.
- Know what each source natively stores. Windows event logs record UTC and Event Viewer renders them in the local zone of whatever machine you opened them on. NTFS stores UTC. Classic syslog lines carry neither a year nor a zone, so you supply both from context.
- Convert once, at ingest, and keep the original string in its own column so a bad conversion stays discoverable.
Anchor, then expand
Start at the alert, not at the beginning of time. Take the one event you are certain about - the EDR detection, the 4624, the file write - and pull everything on that host in a window around it. Widen until the activity stops being interesting in both directions. This is how you avoid reading six months of disk activity to explain a Tuesday.
Know what each artifact proves
Several Windows artifacts look like execution evidence and are not. This is where timelines go wrong.
- Event logs and Sysmon - the strongest source. Sysmon Event ID 1 carries process, parent, command line and hashes. Security 4624/4625 carry authentication with logon type, and 4698 scheduled-task creation; service installation is 7045 in the System log, not Security.
- Prefetch (
C:\Windows\Prefetch\*.pf) - proves execution, with a run count and the last eight run times. On by default on client Windows, generally not on Server. $MFT- file creation, modification and access times.$STANDARD_INFORMATIONtimestamps can be set by anything that can write the file (timestomping);$FILE_NAMEtimestamps are maintained by the kernel. An$SIcreation time older than the$FNcreation time deserves a very close look.- USN journal (
$Extend\$UsnJrnl:$J) - creates, renames and deletes, including for files that no longer exist. This is where dropped-then-cleaned-up tooling shows itself. - ShimCache and Amcache - evidence of presence, not proof of execution. The ShimCache (AppCompatCache) timestamp is the file's last modified time rather than a run time, and entries are written to the registry at shutdown. Read them as "this binary existed on this host by this point".
- LNK files, jump lists, SRUM, browser history - user and application activity that fills the gaps between the above.
Build it with tools, read it with your eyes
Plaso builds a super timeline from an image or a directory of collected artifacts:
log2timeline.py --storage-file case.plaso /evidence/host01.E01
psort.py -o dynamic -w host01-timeline.csv case.plaso
For targeted Windows artifacts, dedicated parsers are faster and produce cleaner columns:
MFTECmd.exe -f E:\C\$MFT --csv .\out
EvtxECmd.exe -d E:\C\Windows\System32\winevt\Logs --csv .\out
PECmd.exe -d E:\C\Windows\Prefetch --csv .\out
A super timeline of a full disk runs to millions of rows. Producing it is the tool's job; slicing it to the anchored window and the artifacts that answer your question is yours.
Row discipline
Every row carries: UTC timestamp, host, user, source artifact, what happened, evidence reference. If you cannot name the artifact and the file it came from, that row is a note, not evidence.
Keep observation and inference apart. "2026-08-24T14:02:11Z winword.exe spawned powershell.exe (Sysmon 1, host01)" is an observation. "The user opened the malicious attachment" is an inference, and it belongs in the narrative where it can be challenged.
Walk it backwards to patient zero
From the first confirmed malicious execution, pivot to the parent process. Then ask how the parent got its input: a file write, a download, a mail delivery, a remote logon. Repeat until you reach something that came from outside your estate. That is patient zero, and it is what your lessons-learned and your new detection should target.
The deliverable is two things
The table - exhaustive, in UTC, every row sourced - and a narrative of fifteen or twenty lines that an executive can read. Every sentence in the narrative must be traceable to rows in the table. Write the narrative last, because until you can write it in plain language you have not finished the investigation.