Timeline Analysis with The Sleuth Kit

"When did it happen?" is the question every investigation orbits. A timeline turns a static disk image into a chronological story by collecting the timestamps that filesystem metadata already records. On Linux, the tools are The Sleuth Kit (TSK) — the same engine that powers Autopsy — and its companion mactime.

Why timelines?

Files don't just sit there — they are created, modified, accessed, renamed, and deleted, and the filesystem remembers when. A timeline lets you:

• Find the first change — usually the moment of compromise.
• Cluster activity around a suspicious event (e.g. a new user, a modified service).
• Spot anti-forensics: mass timestamp edits, deletions, or gaps.
• Correlate filesystem events with log entries to build a coherent story.

MAC times: the raw material

Each file and directory inode records several timestamps. You'll hear these called "MAC times", though modern filesystems add more:

On ext4, ctime updates whenever the inode changes — so renaming, chmod, chown, or writing content all bump it. The birth time, where available, is a gift: it tells you when a file first came into existence on that filesystem.

Building a timeline: fls + mactime

TSK uses a two-step pipeline. First, walk the filesystem and dump every inode:

# fls -r: recursive listing, output to the timeline body format
fls -r -m / -f ext4 /evidence/image.dd > /evidence/body.txt

# -m / means paths start at root for nicer display names
head -3 /evidence/body.txt

Then feed the body file to mactime to produce a sorted timeline:

# mactime -b bodyfile -d = dates, -z UTC (filesystem times are UTC)
mactime -b /evidence/body.txt -d -z UTC > /evidence/timeline.csv

# a single day of interest, filtered
mactime -b /evidence/body.txt -z UTC "08/10/2026" "08/12/2026" > window.csv

Reading a timeline

Wed Aug 12 2026 03:14:07  d/d -rwxr-xr-x  0    0-0   4096  1000/bob  /home/bob/.ssh
Wed Aug 12 2026 03:14:09  .a. -rw-r--r--  0    0-0    389  1000/bob  /home/bob/.ssh/authorized_keys
Wed Aug 12 2026 03:14:10  m.c -rwxr-xr-x  0    0-0  12872  0-0      /usr/lib/systemd/system/sshd.service
Wed Aug 12 2026 03:14:12  m.c -rw-r--r--  0    0-0    123  0-0      /etc/cron.d/update

The flags before the filename show which timestamps fired: m = modified, a = accessed, c = changed, b = born. A line reading m.c for a file being edited; a line with only .a. is someone merely reading it.

In this (synthetic) example, an SSH key was dropped, sshd's service file was modified, and a cron job appeared — all within five seconds. That cluster is your incident.

Timelining with Autopsy

If command-line timeline reading feels heavy, Autopsy gives you the same TSK engine with a clickable timeline view, keyword filtering, and reports. Use it for exploration, then export the raw timeline for the report.

Tips for effective analysis

• Always generate the timeline from the image, never the live system.
• Look for clusters of activity around an event, not single files.
• New dotfiles, modified service units, and cron entries near the same timestamp = persistence attempt.
• Cross-reference with auth logs: a login followed by a file burst is your narrative.
• Deleted files appear in the timeline too (TSK includes unallocated inodes) — don't skip the *-marked rows.

Full command reference for fls, icat, istat and friends is in the The Sleuth Kit tool guide.

← Previous: Memory Forensics  ·  Next: Where Evidence Hides →