Digital Evidence Timeline Builder: A Browser-Based Tool for Digital Forensic Timeline Analysis
DOI:
https://doi.org/10.46610/JISST.2026.v05i03.004Keywords:
Behavior-based detection, Cybersecurity, Machine learning, Malware classification, Threat mitigation, Windows securityAbstract
Organizing digital evidence into a structured chronological view is a routine but labour-intensive task in digital forensics and cyber incident response. Analysts often do this manually in spreadsheets or documents, which offer little support for structured metadata, filtering, or visual review. This paper presents the Digital Evidence Timeline Builder, a prototype browser-based tool implemented in HTML, CSS, and JavaScript. It allows an analyst to manually record evidence events (timestamp, category, severity, description, artefact source, file hash, analyst name, and tags), sorts them chronologically, displays them on an interactive timeline grouped by date, filters them by category and severity, summarizes them on a dashboard, exchanges case data as JSON, and generates a PDF report. The tool is not an artefact parser or an acquisition/analysis suite. It targets a niche that established tools such as Plaso, Timesketch, Autopsy, and DFIR-IRIS serve differently: a zero-installation, offline, analyst-curated timeline for evidence that has already been acquired. The prototype was evaluated by functional testing against a documented protocol comprising defined test cases, explicit pass/fail criteria, a described test environment, and a repeatability procedure. Results are reported as qualitative functional verification (pass/fail); no accuracy percentages and no measured efficiency gains are claimed. The paper also states the prototype’s forensic-validity limitations: it does not validate timestamps, handle time zones or clock drift, compute or verify hashes, enforce chain of custody, keep an audit log, or protect exported case files from modification. The tool is therefore a documentation and visualization aid to be used alongside, not instead of, forensically sound acquisition, preservation, and analysis procedures.
References
A. Nelson, S. Rekhi, M. Souppaya, and K. Scarfone, “Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile,” NIST Special Publication 800-61 Rev. 3, National Institute of Standards and Technology, Gaithersburg, MD, USA, Apr. 2025.
ISO/IEC, Information technology Security techniques Guidelines for identification, collection, acquisition and preservation of digital evidence, ISO/IEC 27037:2012, 1st ed., Oct. 2012.
ISO/IEC, Information technology Security techniques Incident investigation principles and processes, ISO/IEC 27043:2015, 1st ed., Mar. 2015.
ISO/IEC, Information technology Security techniques Guidelines for the analysis and interpretation of digital evidence, ISO/IEC 27042:2015, 1st ed., Jun. 2015.
F. Breitinger, H. Studiawan, and C. Hargreaves, “SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges,” Forensic Science International: Digital Investigation, vol. 53, Jul. 2025.
C. Vanini, C. J. Hargreaves, H. van Beek, F. Breitinger, “Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction,” Forensic Science International: Digital Investigation, vol. 49, Jul. 2024.
K. Scarfone and M. Souppaya, “Cybersecurity log management planning guide,” NIST Special Publication 800-92 Rev. 1, Initial Public Draft, National Institute of Standards and Technology, Oct. 2023.
Plaso Project, “Plaso: Super timeline all the things,” GitHub repository. Available: https://github.com/log2timeline/plaso
Google, “Timesketch: Collaborative forensic timeline analysis,” GitHub repository. Available: https://github.com/google/timesketch
Sleuth Kit Labs, “Autopsy digital forensics platform,” software documentation. Available: https://www.sleuthkit.org/autopsy/
DFIR-IRIS Team, “DFIR-IRIS: Collaborative incident response platform,” GitHub repository. Available: https://github.com/dfir-iris/iris-web
C. Altheide and H. Carvey, Digital Forensics with Open Source Tools. Waltham, MA, USA: Syngress, 2011.
Scientific Working Group on Digital Evidence (SWGDE), “Best practices for on-scene identification, seizure, and preservation of Internet of Things (IoT) devices,” SWGDE Document 22-F-001-1.0, Sep. 2022.
MITRE ATT&CK, “Enterprise Matrix,” MITRE ATT&CK Framework. Available: https://attack.mitre.org/matrices/enterprise/
I. Ismail, K. A. Zainol Ariffin, “The admissibility of digital evidence from open-source forensic tools: Development of a framework for legal acceptance,” PLoS One, vol. 20, no. 9, 2025.
