Chapter 21 — Further Reading

Timeline analysis rewards two kinds of study: knowing the structures (epochs, the MFT's two timestamp sets, the change journal) well enough to defend a finding byte by byte, and knowing the tooling (plaso, the Sleuth Kit, the EZ tools) well enough to assemble a million-line timeline and find the story in it. Start with the authority on the file system, then the tool authors' own documentation, then the DFIR practitioners who teach the method of reading a timeline rather than just running one.

Foundations (🔬 deeper / structure-level)

• Brian Carrier, File System Forensic Analysis. The standard reference for NTFS internals — the MFT, the $STANDARD_INFORMATION` and `$FILE_NAME attributes, and exactly how the two MACB sets are written and by whom. When a timestomping finding is contested, this is the source you cite for why $FN is the trustworthy clock.
• The plaso documentation (plaso.readthedocs.io). The engine behind log2timeline.py/psort.py: the parser list, the storage format, the filtering syntax, and the timestamp_desc field that tells you which clock fired. Read the "Scribbles"/usage guides before your first large super-timeline.
• Microsoft docs: the FILETIME structure and Windows Security event 4616. The primary references for the 100-ns/1601 epoch and for the "system time was changed" event — including which fields record the old/new values and the responsible account.

Approachable explanations (everyone)

• SANS DFIR posters and blog (the Windows Forensic Analysis poster; Rob Lee and the FOR500/FOR508 team). The single best one-page map of artifact-to-timestamp relationships, and clear write-ups of super-timeline methodology and the "pivot from anchors" workflow.
• **13Cubed (Richard Davis), the MFT, $UsnJrnl`, and timestomping episodes.** Short, precise video walk-throughs of decoding `$SI vs. $FN, spotting zeroed sub-seconds, and corroborating with the change journal — the chapter's detection core, demonstrated on real records.
• Eric Zimmerman's tool documentation and TimeApp. The "what each tool does and why" for MFTECmd, Timeline Explorer, and the format converters; keep TimeApp open during analysis to turn any raw value into a human date instantly.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 plaso + psort.py filters + Timeline Explorer. The working trio: collect everything, slice to the window and sources, read and tag in Timeline Explorer. Pair with MFTECmd so $SI` and `$FN are visible side by side.
• 🛡️ KAPE + the Sleuth Kit (fls/mactime). For responders: triage-collect, then build a fast file-system spine to bound an intrusion's blast radius before the full plaso run finishes.
• 📜 Normalization and skew discipline for testimony. The chain-of-custody sentence about the time standard, the skew measurement against an external reference, and the 4616 check are what make a timeline survive a Daubert challenge (Chapter 27).

Reference (this book)

• Appendix G — File System Reference: the NTFS MFT entry, $SI`/`$FN attribute layouts, and ext4/APFS time fields behind every MACB letter in this chapter.
• Appendix H — Command-Line Reference: the full fls/mactime, log2timeline.py/psort.py, and MFTECmd option sets.
• Appendix B — Python Forensics Toolkit: the epoch-conversion functions, scriptable for batch normalization.
• Chapter 4 — File Systems, Chapter 16 — Windows Forensics, Chapter 26 — The Forensic Report, and Chapter 30 — Anti-Forensics: the surrounding workflow.

Do, don't just read

• Build one super-timeline end to end. On a practice image (Appendix J), run fls/mactime for the spine and log2timeline.py/psort.py for the full picture, then load both into Timeline Explorer, pivot from one anchor, and write a five-line sourced exhibit. You do not understand timelines until you have drowned in a raw one and then filtered your way out.
• Catch a timestomp, then catch yourself. Decode one file's $SI` and `$FN by hand and corroborate with $UsnJrnl:$J. Then deliberately reproduce the Case Study 2 mistake — merge a UTC log and a local FAT time without converting — and watch the sequence invert. Feeling a timeline run backwards once teaches the discipline better than any rule.

Next: Chapter 22 — Memory Forensics: leave the timestamps on disk for the volatile world of RAM — running processes, network connections, injected code, and encryption keys that live only until power is lost — and add a layer of now to the then you just reconstructed.