A forensic timeline is the ordered sequence of events investigators build from logs, alerts, file metadata, network traces, and system clocks. It helps answer what happened first, what followed, and which actions were connected. In cyber security, this matters because incident response depends on separating cause from effect and on matching evidence across different systems.
Attackers often try to weaken timelines by deleting logs, altering timestamps, or causing clock drift, which can make events appear out of order or hide the real entry point. Defenders use synchronized time sources, centralized logging, and careful correlation to rebuild a reliable sequence. A strong forensic timeline turns scattered records into evidence that can support detection, containment, and post-incident analysis.