Case Study 2 — The Timeline That Ran Backwards

The mirror image of Case Study 1: not a timeline that survived cross-examination, but one that should never have left the lab. An internal examiner laid UTC server logs, local-time workstation artifacts, and a FAT thumb drive's local timestamps on one axis without converting any of them, missed a clock change recorded in the very logs they were reading, and produced a sequence that accused an employee of leaking a document she did not yet have. The suspicion may even have been worth investigating — but the timeline that "proved" it ran backwards.

Background

A freight-logistics firm was bidding on a large municipal contract. When a competitor's offer came in suspiciously close to the firm's sealed number, suspicion fell on dliu, an analyst with access to the bid workbook. An internal IT examiner — capable with the tools, but self-taught and never cross-examined — was asked to "build a timeline" of dliu's activity on her workstation LOG-WS-11. Within a day the examiner produced a one-page exhibit and a confident conclusion: that dliu had opened the sealed bid, copied it to a personal USB drive, and emailed it to a personal account, all within a twenty-two-minute window. On the strength of that exhibit she was terminated. Her attorney retained an independent examiner, and the timeline came apart along exactly the fault lines this chapter warns about.

What the review found

The examiner's exhibit looked clean — a tidy table of times and events. The problem was that almost none of the times meant what the table implied.

THE FLAWED EXHIBIT (as produced)            "all times" — but from THREE different clocks
13:50  Opened RFP-4471_FinalBid.pdf          [$SI Accessed, shown in machine LOCAL time]
14:05  Copied bid file to USB (drive F:)      [FAT thumb-drive write time, LOCAL — other PC]
14:12  Emailed personal account               [mail-server Received header, UTC]
   ⇒ examiner's conclusion: access → copy → exfiltrate, 22-minute window

Failure 1 — Three clocks, one axis, no conversion (the cardinal sin). The three load-bearing lines came from three sources in three time standards, dropped onto one timeline untouched. The workstation artifacts were displayed in the machine's local zone (Eastern, UTC−4 during daylight time). The mail-server Received header was UTC. And the USB write time came from a FAT volume that had been formatted and last written on a different computer in the Central zone — local time with no zone recorded at all. Converted properly to UTC, the email was sent at 18:12, the file-open artifact resolved to 17:50, and the FAT write — once its Central origin was established — was 19:05, not 18:05. The "22-minute exfiltration window" was an artifact of mixing zones; in UTC the events did not even fall in the order the exhibit claimed.

Failure 2 — A clock change sitting in the logs, unread. The independent examiner did what the first had not: checked for event ID 4616, "the system time was changed." There were two. Earlier that day an IT technician, troubleshooting an unrelated sync problem, had rolled LOG-WS-11's clock back ninety minutes and then corrected it an hour later. Every workstation timestamp written inside that window — including the artifact the examiner read as a "13:50 file open" — was recorded against a clock that was ninety minutes wrong. The correct response was to segment the timeline at each 4616 and re-anchor; the first examiner had applied no correction because they had never looked.

Failure 3 — The last-access trap. The "opened the bid at 13:50" claim rested entirely on the bid PDF's $STANDARD_INFORMATION Accessed time. But LOG-WS-11 ran Windows 10 with last-access updates disabled by default, as Vista-and-later machines are. The A time was stale — it predated the bid's existence on the machine — and did not represent an open at all. The examiner had presented a timestamp the operating system was not even maintaining as proof of a deliberate act.

Failure 4 — $SI` trusted, `$FN and the USN journal never consulted. The "copied the bid to USB" claim came from an Explorer-visible $SI` time on a local file. The independent examiner pulled `$SI and $FN` together with `MFTECmd` and read the `$Extend\$UsnJrnl:$J change journal. The local file the examiner had taken for a user copy of the bid was created by a scheduled software-deployment process (the USN reason flags and the $FN`/`$SI agreement showed a system-driven write, not an interactive copy), and the files actually written to the FAT thumb drive were, by their $FN names and the USN records, dliu's personal photographs — a routine backup of her own data.

Failure 5 — No skew measurement, no custody. The examiner never measured the workstation clock against any external reference, never imaged the USB drive (working from a directory listing taken on the live machine), and never hashed a working copy or recorded a chain of custody. Even the observations that were technically real could not be tied to a known, unaltered source.

When every source was converted to UTC, the two 4616 events segmented, the last-access claim discarded, and $FN/USN consulted, the sequence inverted:

CORRECTED TIMELINE (UTC, segmented at the 4616 clock changes)
17:50  $SI Accessed time on bid PDF = STALE (last-access disabled) — NOT an open
18:12  dliu emails personal account — a calendar invite, no attachment   [mail Received, UTC]
19:05  Personal photos backed up to FAT thumb drive (her own data)        [$FN + USN, UTC]
─────────────────────────────────────────────────────────────────────────────────────
20:41  RFP-4471_FinalBid.pdf FIRST ARRIVES in dliu's mailbox              [mail Received, UTC]
   ⇒ the bid did not reach the workstation until AFTER every event the exhibit cited.

The document the exhibit accused dliu of exfiltrating did not arrive on her workstation until more than an hour after the last event the examiner had cited. She could not have copied or emailed a file she did not yet possess. The independent review's conclusion was deliberately modest and therefore unshakable: the available evidence, normalized to UTC and corrected for two recorded clock changes, does not place the bid document on the workstation until after the cited activity; the cited "access" rests on a disabled last-access time; and the USB and email events are consistent with routine personal use. The temporal evidence does not support the alleged exfiltration. dliu was reinstated and the matter settled.

The bitter part, as in every cautionary tale, is that a disciplined examination might have reached a defensible answer either way. Perhaps a real leak happened through a channel the examiner never looked at; perhaps it did not. But a timeline is not paid to be quickly suggestive — it is paid to be defensible in public, and one built on three unconverted clocks, an unread clock change, and a timestamp the OS was not maintaining is not a timeline at all. It is a coincidence dressed as a sequence.

The analysis

  1. Mixing time zones can invert a sequence — it is the cardinal sin. UTC server logs, local-time workstation artifacts, and zone-less FAT timestamps on one axis without conversion produced an order of events that simply was not real. Build in UTC, convert every source, and translate to local only at the end.
  2. Always check for event ID 4616 and segment at every clock change. A clock rolled back ninety minutes makes every timestamp written in that window meaningless until corrected. The change was recorded in the logs the examiner was already reading; not looking is not an excuse.
  3. Last-access time is not "last opened." With updates disabled by default since Vista, a stale $SI Accessed time proves nothing about whether a file was opened. Presenting it as a deliberate access is a credibility-ending error.
  4. Trust $FN` and the USN journal over Explorer's `$SI. The "user copied the bid" claim dissolved the moment $FN and the change journal showed a software-deployment write and a personal-photo backup. When timing matters, never rest on the forgeable, Explorer-visible set.
  5. Measure skew, image the media, keep custody — even in an HR matter. No external clock reference, no USB image, no hash, no chain of custody means even correct observations cannot be tied to a known source. A right suspicion reported without discipline is worth nothing — and a wrong one can cost someone their job.

Discussion questions

  1. Rewrite the examiner's central claim — "dliu opened, copied, and emailed the sealed bid in a 22-minute window" — into a finding the independent examiner could not have impeached, given what the evidence actually supports. What is the most that could honestly be said?
  2. The three load-bearing lines came from a local-time workstation, a UTC mail server, and a FAT drive written in Central time. For each, explain exactly what conversion was required and how omitting it shifted the event on the axis.
  3. Two event ID 4616 records were sitting in the logs the first examiner read. Explain why "segment the timeline at each clock change and re-anchor" is the correct response, and why "apply one constant offset for the day" would have been wrong here.
  4. ⭐ Contrast this case with Case Study 1: both examiners built a timeline of a suspected insider, but one survived arbitration and the other collapsed on review. Identify the single habit most responsible for the difference, then draft a six-line pre-exhibit checklist (drawn from this chapter) that would have caught all five failures here.
  5. Suppose a disciplined re-examination had shown a genuine leak — the bid arriving at 13:00 UTC, opened from an interactive session confirmed by a non-stale LNK and a Jump List, then copied to a USB whose $FN/USN records named the bid file. Write the finding that convergence would support, and the sentence you would add stating what the timeline still cannot establish (for example, intent, or who physically sat at the keyboard).