Place digital events into a trustworthy sequence

Normalise timestamps without altering evidence

After an IT failure, evidence arrives out of order: an employee reports a message, an administrator finds a log entry and a supplier mentions scheduled maintenance. Without structure, the result may be a plausible but inaccurate story. A timeline separates sources, timestamps and events that have actually been established.

Time zones, daylight-saving changes, device clock drift and date formats can produce misleading differences. Preserve original timestamps and record conversions separately. One action may create several technical events, while a human report may be written later. This helps reconstruct the operational sequence without claiming that logs say more than they actually do.

Practical checkpoints

• Keep timestamps in their original form.
• Document time-zone conversions.
• Separate observed actions from reported recollections.
• Clearly identify gaps in the available record.

A timeline that supports decisions

The final record should be readable: event, source, time, confidence level and commentary. Unknown periods should remain visible instead of being filled with assumptions. In business settings, the timeline improves communication among IT support, management, insurers and specialist advisers. It can also identify preventive controls to improve after systems have recovered.

This guide concerns technical analysis, prevention and documentation. Third-party systems require an authorised scope; Pacta does not offer named-person private investigations.

Continue exploring

• Check a suspicious website before sharing information
• Resolve conflicting company information before acting
• Preserve relevant technical records before they disappear
• Structure OSINT research around a specific technical question

View the full section index