Chapter 21 — Key Takeaways

The big idea

A single artifact is a word; the timeline is the sentence — and only the sentence convicts. Almost every other chapter in Part III produces inputs to this one; timeline analysis is the refinery that turns a folder of CSV exports into the chronological narrative a court can act on. The whole craft reduces to a method that outlives every changing format and tool: convert every source's clock to one standard (UTC), account for skew, trust the kernel's clock over the user's, corroborate across independent sources, and state every conclusion with its limits. Build the super-timeline, but never read it raw — pivot from anchors, and remember that a dated gap is itself evidence.

Telling time: epochs and resolution

• A timestamp is a number plus a convention — you must know the epoch (zero point) and the resolution (tick size) before the number means anything. Wrong epoch lands an event in the wrong century; false precision lands you in trouble on cross.
• The two you meet most: FILETIME (100-ns ticks since 1601 UTC — NTFS, registry, .evtx, LNK) and Unix (seconds since 1970 UTC). Bridge them with 116,444,736,000,000,000 (the FILETIME of the Unix epoch).

• Resolution: NTFS 100 ns (UTC) · FAT 2 s (local) · exFAT 10 ms · ext4/APFS 1 ns (UTC). FAT cannot sequence sub-two-second events and carries no zone — the #1 normalization trap. Normalize with the evidence machine's SYSTEM\...\TimeZoneInformation (UTC = local + Bias); measure clock skew against an external reference (mail-server Received, server logs); read event ID 4616 as the fingerprint of a deliberate clock change and segment the timeline at it.

MACB and the two NTFS clocks

• Modified (content) · Accessed (unreliable — disabled by default since Vista) · Changed (metadata: MFT/inode — not creation) · Born (created). The "C" trap snares everyone.
• NTFS keeps two MACB sets: $STANDARD_INFORMATION` (0x10) is what Explorer shows and any user can **forge**; `$FILE_NAME (0x30) is kernel-maintained and truthful. The rule to recite on the stand: trust $FN when the two disagree.
• Born after Modified is normal for a copy or download (new birth, inherited M) — confirm benign by checking that $FN corroborates the recent birth before crying "timestomping."

Catching the lie: timestomping detection

• Forgers write $SI`; the kernel keeps `$FN honest. The tells: $SI` Born earlier than `$FN Born (headline), zeroed .0000000 sub-seconds, $SI M-before-B on a non-copied file, dates predating the OS install, implausible divergence.
• No single tell is conclusive — innocent causes exist (file-system tunneling, restore-from-backup, installers). Corroborate with the $Extend\$UsnJrnl:$J` change journal (`USN_REASON_FILE_CREATE`) and `$LogFile; agreement of $FN` and `$J to the second is the gold standard.

Building and reading the timeline

• fls -m -r → mactime -z UTC = the fast, surgical file-system spine (bodyfile = 11 pipe-delimited fields, Unix epoch). log2timeline.py → psort.py = the comprehensive everything-timeline (100+ parsers, often >1M events). MFTECmd shows $SI` *and* `$FN side by side; triage CSVs in Timeline Explorer, browse counts in Autopsy.
• Read with judgment: anchor → window → expand; a single line is a lead, multiple agreeing sources a finding; proximity ≠ causation; and the gap has coordinates — a wiped log or a stopped history is dated evidence.

You can now…

• ☐ Identify any common timestamp's epoch and resolution and convert it to one UTC standard.
• ☐ Normalize a mixed-source timeline to UTC, measure and document clock skew, and detect event ID 4616 clock changes.
• ☐ Explain MACB precisely (C = metadata-change, B = creation) and map file-system fields to MACB letters.
• ☐ Detect timestomping by comparing $SI` against `$FN and corroborating with the USN journal — and distinguish it from a benign copy.
• ☐ Build a super-timeline with both fls/mactime and log2timeline/plaso, pivot it in Timeline Explorer, and assemble a corroborated, source-annotated master-timeline exhibit.

Looking ahead

Chapter 22 — Memory Forensics. You move from the timestamps on disk to the volatile world of RAM — running processes, network connections, injected code, and encryption keys that live only until power is lost. Captured and analyzed with Volatility, memory adds a layer of now to the then you just learned to reconstruct.

One sentence to carry forward: Convert to one standard, account for skew, trust the kernel's clock over the user's, corroborate across independent sources, and state every conclusion with its limits — the formats change, the method does not.