Timelines That Survive a Hostile Reader

A timeline is the most persuasive artifact an investigator produces, which is why it deserves the most suspicion. Two mechanical errors produce most bad ones.

The first is time zone: log lines in local time, daylight saving transitions, and exports that silently convert. Normalize everything to UTC on entry and keep the original string as recorded.

The second is clock skew. Machine clocks drift, and a host whose synchronization has failed can be minutes or hours off. If one system is eleven minutes fast, its entries appear before events they followed. Measure each source's offset against a trusted reference, write the offset down, and apply it knowingly — never by rewriting the underlying record.

Then use independent sources for anything critical: endpoint, network, application, authentication, provider audit logs. A single log source can be incomplete, rotated away, or edited by whoever you are investigating. Corroboration across sources with different collection mechanisms is what makes a sequence defensible.

Draw gaps as gaps. A period with no data is a period with no data, and spanning it with a smooth line is a claim you did not earn.

Finally, keep causation in a different column from sequence. After is not because — and a timeline's visual grammar makes that error feel like a reading rather than an inference.