What is a defensible digital timeline?¶

A defensible digital timeline is a structured account of relevant events that shows where each entry came from, what it records and how certain the timing and interpretation are.

It is more than a list sorted by timestamp.

Avoid the dangerous assumption¶

The dangerous assumption is that placing records in chronological order automatically creates a reliable narrative.

It does not.

A strong timeline distinguishes source time from ingestion time, local time from UTC and direct observations from investigator inferences. It preserves contradictory entries and visible gaps rather than smoothing them away.

Each entry should identify the source system, original timestamp, time zone, converted time if used, event description, account or device fields, result and relevant identifiers. It should also record any limitation or uncertainty.

The timeline should answer an investigative question. Irrelevant technical noise should not overwhelm the significant sequence, but exclusion decisions should be proportionate and explainable.

Correlated events should be linked using evidence, not merely proximity. Where one event may have caused another, the timeline should distinguish technical sequence from proven causation.

Investigators should preserve the underlying records and make the timeline reproducible. Another person should be able to trace each entry back to its source.

Where timing remains uncertain, use ranges or qualified language. Do not invent precision to make the timeline look cleaner.

The timeline should also distinguish preserved source facts from explanatory notes added later, so that interpretation never becomes confused with the original evidence.

Operational takeaway¶

A defensible digital timeline preserves source, timing, uncertainty and interpretation for every significant entry, allowing the sequence to be reviewed without confusing chronological presentation with proof of causation or attribution.