In digital forensics, which sources are commonly used to construct a forensic timeline?

• A. Only antivirus scan results.
• B. Timestamps from logs, file metadata, registry events, and network captures.
• C. Employee interviews.
• D. Backup rotation schedules.

Answer: (B)

Constructing a forensic timeline relies on collecting a variety of time-stamped evidence from multiple sources and aligning them to tell the sequence of events. Timestamps from logs (such as system, security, and application logs) give precise moments when actions occurred. File metadata (created, modified, accessed times on files) shows when files were handled or changed. Registry events on Windows record configuration changes and activity that can indicate user or process actions. Network captures provide packet-level timestamps and flow information that place events in a live communications context. Together, these sources offer corroborating, cross-referenced time data that can be normalized to a common reference (like UTC) to construct an accurate timeline.

Other options don’t fit as well because they don’t routinely provide a reliable, comprehensive sequence of events. Antivirus scan results offer detections but not a complete action chronology. Employee interviews can help interpret what happened but aren’t precise time-stamped records. Backup rotation schedules indicate data availability but not the actual sequence of events.