Chapter 04 of 07 · Digital Forensics & Incident Response
Building the Timeline
When it started, what happened in order, and what has been cleaned.
FreeMedium
1 lesson6 quiz questionsabout 3 minup to 40 XP
One-sided — Timeline reconstruction reads evidence. The attack that produced it is taught elsewhere; this chapter begins with the artefacts already on disk.
Start this chapterWhen Did It Start