FieldP-07 · UTC, offsets, independent sources
Build a Defensible Timeline
Reconstruct sequence without inventing causation.
Step 1
Normalize to UTC
Convert everything on entry and keep the original string as recorded. Daylight saving is the most common silent error in a timeline.
Step 2
Record Each Source’s Clock Offset
Compare each system’s clock against a trusted reference and write the drift down. Unsynchronized clocks make events appear out of order.
Step 3
Use Independent Sources Per Event
Endpoint, network, application, authentication, provider audit logs. One source can be incomplete, rotated, or edited by whoever you are investigating.
Step 4
Mark Retention Gaps
A period with no data is a period with no data. Draw it; do not span it.
Step 5
Separate Sequence From Cause
After is not because. Keep the causal claim in a separate column from the timeline itself.
Step 6
Re-Derive From the Raw Data Once
Rebuild a critical stretch of the timeline from source records without looking at your own summary.
How It Fails
The elegant chain of events that was assembled out of one log source and a time zone mistake.