Create investigation timelines with the collected evidence to gain insight into the context of an incident.
The following table outlines the actions available in the Timeline screen.
Action
|
Description
|
Filter timeline elements
|
Use the dropdown lists and specify the operating system to locate
specific timeline entries.
|
Add a custom element to the timeline
|
Click the Add Element icon (
![]() |
Delete elements from the timeline
|
Select one or more elements from the timeline and then click Delete Selected.
|
Reset timeline
|
Click the options icon (
![]() |
Add timeline to sub case
|
Click the options icon (
![]() |