Adding Elements to an Investigation Timeline

Create an investigation timeline with the collected evidence to gain insight into the context of an incident.

1. In a workspace, find an evidence package, click the options icon () at the end of the row, and click View Evidence Report.

   The evidence report appears.

2. Locate the evidence you want to add to the timeline

   Click on the available evidence categories and use the search box to filter the evidence results.

3. Click Add to Timeline.
   Note:

   • All elements on screen are added to the timeline.

   • You can only add 1000 elements at a time.

4. Select a timestamp type. The Forensics and Analysis orders evidence in a timeline based on the selected timestamp type.
5. Select a timeline.

   • New timeline: Specify a name for the new timeline

     Note:

     Each evidence report can have up to 10 timelines.

   • Existing timeline: Select an existing timeline from the menu

6. Click Create.
   Important:

   • Timelines can have up to 100,000 elements.

   The Forensics and Analysis app starts adding elements to the timeline.