What is a timeline analysis and why is it essential in incident investigations?

• A. Timeline analysis orders events from artifacts and logs to reconstruct the incident and understand attacker actions and dwell time
• B. It analyzes network throughput over time
• C. It measures system uptime
• D. It predicts future incidents with machine learning

Answer: (A)

Timeline analysis is the process of ordering events from artifacts and logs to reconstruct what happened during an incident. In incident investigations, this approach is essential because it reveals the exact sequence of attacker actions, when the intrusion began, how long the attacker remained in the environment (dwell time), and which systems and data were affected. By weaving together timestamps from file metadata, registry changes, log entries, authentication events, and network device records, investigators can map an attacker’s movement, identify pivot points, and determine containment and remediation steps with confidence.

Helpful context: timeline analysis helps verify hypotheses about how the breach unfolded, point out gaps in detection, and provide a coherent narrative that guides decisions on eradication and recovery. It also supports post-incident lessons by showing where controls failed and how similar activity might be detected earlier in the future.

Why the other options don’t fit: one option focuses on network throughput over time, which is a network performance metric rather than reconstructing a past incident. Another centers on measuring system uptime, which deals with reliability metrics, not incident sequencing. The last option mentions predicting future incidents with machine learning, which is predictive analytics and not about reconstructing what happened in a past incident.