Which tools are commonly used for timeline creation and visualization in FOR508 practice?

• A. EnCase and FTK Imager
• B. Plaso (log2timeline) to create timelines and Timesketch to visualize and analyze them
• C. Wireshark and tcpdump
• D. Volatility and Rekall

Answer: (B)

Timeline creation and visualization involves gathering events from many different sources, normalizing their timestamps, and organizing them so you can see the sequence of actions and how they relate. The best match for this in FOR508 practice is using a tool to extract the events across diverse artifacts and another to visualize and analyze them.

Plaso (log2timeline) is built to parse a wide range of data sources—such as filesystem artifacts, browser histories, event logs, and more—and output a cohesive timeline of events. This step is about compiling the evidence into a chronological record that preserves timing and relationships.

Timesketch is a browser-based platform that ingests that timeline data and provides powerful visualization, searching, filtering, and collaboration features. It helps you explore the timeline, identify patterns, correlate events, and communicate findings.

So, pairing Plaso to create the timeline with Timesketch to visualize and analyze it is the standard approach in FOR508 practice. The other tools mentioned focus on different tasks—disk imaging (EnCase, FTK Imager), network capture/analysis (Wireshark, tcpdump), and memory forensics (Volatility, Rekall)—and aren’t designed for the full timeline creation and visualization workflow.