Overview
Timestamps anchor evidence in time, enabling accurate timelines and correlation. This lesson covers timestamps in evidence collection.
Learning objectives
- Explain the role of timestamps in evidence.
- Describe accurate, consistent timestamping.
- Connect timestamps to timelines and deconfliction.
Core concept
Timestamps record when each piece of evidence was captured or each action was taken. They are essential for building accurate timelines of the engagement, correlating the tester's activity with the target's logs (deconfliction — distinguishing test from real events), and establishing the sequence of a demonstrated attack. Timestamps must be accurate and consistent (ideally referenced to a known time source and time zone, e.g. UTC, as in the Linux timestamps lesson) so that evidence from different sources can be reliably correlated.
How it works
As the tester captures evidence and performs actions, each is recorded with an accurate timestamp. Consistency matters: using a synchronized clock and a consistent time reference (e.g. UTC, noting offsets) ensures that the tester's timeline aligns with the target's logs and other evidence. This enables correlation — matching a test action to the corresponding log entry (confirming "that alert was our test") — and reconstructs the order of events in a demonstrated finding. Inaccurate or inconsistent timestamps break correlation and can misrepresent what happened when. Timestamping is thus a small but critical discipline in evidence quality.
Practical example
During an engagement, the tester records that a particular action was performed at a specific UTC time and captures the resulting evidence with the same timestamp. Later, the owner's team correlates their logs to that timestamp and confirms the logged event was the test, not a real attacker (deconfliction). The consistent, accurate timestamps also let the report present a clear sequence of a multi-step finding. Had timestamps been missing or inconsistent, this correlation and sequencing would have been unreliable.
Cybersecurity relevance
Timestamps underpin timelines, correlation, and deconfliction — essential for both the engagement's reporting and the owner's ability to distinguish authorized testing from real incidents. Accurate, synchronized time (referenced consistently, e.g. UTC) is what makes cross-source correlation valid, echoing the Linux timestamps lesson and forensic practice. In incident response and forensics generally, timestamps are the backbone of reconstructing events. For assessments, they ensure evidence is anchored and the sequence of findings is clear. Poor timestamping undermines these, so it is a key evidence discipline.
Common mistakes
- Missing timestamps on evidence/actions, breaking timelines and correlation.
- Inconsistent time references/zones, misaligning evidence across sources.
- Relying on an unsynchronized clock, producing inaccurate timestamps.
Key takeaways
- Timestamps record when evidence was captured/actions taken, enabling accurate timelines, correlation with target logs, and deconfliction (test vs real events).
- They must be accurate and consistently referenced (e.g. synchronized to UTC, noting offsets) so evidence from different sources correlates reliably.
- Good timestamping supports reporting and the owner's incident distinction; poor timestamping undermines correlation and sequencing — a key evidence discipline.
Check your understanding
- Why are accurate, consistent timestamps essential for correlating tester activity with target logs?
- How do timestamps support deconfliction (distinguishing authorized testing from a real incident)?