Building a Super-Timeline: Merging All Artefacts into One Story

Prerequisites

• DFA-K003: NTFS Forensics
• DFA-K005: Memory Forensics
• DFA-K006: Windows Event Log Forensics

Why This Lesson Matters

Forensic investigation using individual artefact sources — registry here, event log there, PCAP separately — is like reading a novel one chapter at a time from different copies, in different languages. A super-timeline merges every artefact source into a single chronological sequence, in one language: time. It is the single most powerful analytical technique in digital forensics, and log2timeline/plaso makes it achievable without manual correlation.

1. What a Super-Timeline Is

A super-timeline is a merged, sorted, deduplicated timeline of every timestamped artefact from a forensic image or evidence set. A single investigation may combine:

• MFT file timestamps (MACB)
• Registry last-written timestamps
• Event log entries (Security, System, Sysmon)
• Browser history timestamps
• Prefetch execution timestamps
• LNK file timestamps
• Recycle Bin timestamps
• Shellbag timestamps

The result is a single CSV with potentially millions of rows covering days or weeks of system activity.

2. log2timeline/plaso: The Pipeline

plaso (Plaso Langar Að Safna Og) is the engine. log2timeline is the main input tool. psort is the output formatter.

Disk image / Evidence files
          ↓
    log2timeline.py          → creates a .plaso database (binary)
          ↓
      psort.py               → filters, sorts, exports to CSV/JSON
          ↓
    Timeline Explorer         → GUI analysis (Eric Zimmerman, Windows)
    OR: pandas / grep         → CLI analysis (Linux)

2.1 Creating the Plaso Database

# Image an NTFS volume
log2timeline.py 
  --storage-file /cases/IR-001/timeline.plaso 
  --parsers win10                  # use Windows 10 parser preset
  disk.img

# For a directory of artefacts (if you exported logs/hives first)
log2timeline.py 
  --storage-file /cases/IR-001/timeline.plaso 
  /cases/IR-001/artefacts/

# Time estimate: ~30 min per 100 GB disk image

2.2 Exporting to CSV with psort

# Export everything to CSV (can be millions of rows)
psort.py -o l2tcsv 
  -w /cases/IR-001/supertimeline.csv 
  /cases/IR-001/timeline.plaso

# Filter to a time window (reduces rows dramatically)
psort.py -o l2tcsv 
  -w /cases/IR-001/incident_window.csv 
  /cases/IR-001/timeline.plaso 
  "date > '2026-06-08 14:00:00' AND date < '2026-06-08 16:00:00'"

3. Reading the Timeline

The CSV format has these key columns:

3.1 Filtering the Timeline

import pandas as pd

df = pd.read_csv("incident_window.csv", low_memory=False)

# Focus on the 30 minutes around the confirmed compromise
window = df[(df["datetime"] >= "2026-06-08 14:25:00") &
            (df["datetime"] <= "2026-06-08 15:05:00")]

# Find file creation events
file_creates = window[window["timestamp_desc"].str.contains("Created", na=False)]

# Find registry writes
reg_writes = window[window["source"] == "REG"]

# Find execution artefacts
execution = window[window["source"].isin(["EVTX", "PREFETCH", "SHIMCACHE"])]

# Print the full timeline for manual review
print(window[["datetime","timestamp_desc","source","message"]].to_string())

3.2 Pivot Points: Anchoring the Timeline

A pivot point is a timestamp you are confident about — one that connects your timeline to a specific attacker action.

Pivot 1: auth.log shows SSH login at 14:30:48 UTC
→ In the timeline, look at ±2 minutes around this timestamp
→ What files were created? What registry keys changed? What executed?

Pivot 2: Event 7045 (service install) at 14:32:41 UTC
→ In the timeline, look at the file creation of update.exe in /Users/Public
→ Does the MFT creation timestamp match 14:32:41? (Confirms it was just written)
→ Or was it there days earlier? (Suggests pre-staged payload)

4. Anti-Forensics in the Timeline

The timeline will surface anti-forensic activity:

5. Common Mistakes

Mistake 1: Exporting the full timeline without a time filter. A 500 GB disk produces a CSV with millions of rows. Without a time filter, analysis is paralysed. Always establish your incident window first and filter to it.

Mistake 2: Not using pivot points. Browsing a super-timeline without anchors is overwhelming. Identify 2–3 high-confidence timestamps first, then radiate outward.

Mistake 3: Treating the timeline as the investigation. The timeline shows what happened. It does not explain why. The analyst's job is to interpret the timeline: "these file modifications immediately after the SSH login indicate payload staging, not coincidence."

6. Practice Exercises

1. psort.py produces a CSV with 4.2 million rows. You know the incident occurred between 14:00 and 15:00 UTC on 2026-06-08. Write the psort filter command to limit the export to this window.

2. The super-timeline shows: at 14:32:41 UTC, update.exe has timestamp_desc="File Created" with source="NTFS:$MFT". But istat shows $STANDARD_INFORMATION born = 2024-01-01. What technique is indicated? Which timestamp do you trust more and why?

3. You are building a timeline narrative. You have three pivot points: SSH login (14:30:48), service install (14:32:41), C2 connection (14:31:15). Put them in order and describe what the gap between each tells you about the attacker's actions.

7. Lab

Assessment mode: quiz

Given a pre-built super-timeline CSV (10,000 rows, filtered to a 2-hour window), answer 5 questions: - What was the first file created after the SSH login pivot? - What registry key was written 2 seconds after the service install? - What evidence of anti-forensics appears in the timeline? - What is the last attacker action before containment? - At what timestamp does the attacker's presence end?

8. Framework Alignment

9. Further Reading

• plaso documentation — https://plaso.readthedocs.io — Full parser and output format reference
• Timeline Explorer (Eric Zimmerman) — https://ericzimmerman.github.io — Best GUI for viewing CSV super-timelines
• SANS FOR508 — The super-timeline workflow forms the spine of this course

["Run log2timeline on a disk image or artefact directory to create a plaso database, then use psort to export a time-filtered CSV covering a 2-hour incident window", "Use pandas to filter a super-timeline CSV for file creation events, registry writes, and execution artefacts, and identify three pivot points that anchor the attacker's activity", "Detect a timestomping artefact in a super-timeline by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps for the same file and explain which timestamp is more trustworthy and why"]

Prerequisites → Why this matters (novel analogy) → What a super-timeline is → log2timeline/plaso pipeline → Creating the plaso database → Exporting to CSV with psort (time filter) → Reading the timeline (columns, pandas filtering) → Pivot points → Anti-forensics signatures in the timeline → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading