The process of correlating events across devices, logs, and artifacts using timestamps. In digital investigations, timelines may combine file system events, login records, browser history, chat activity, GPS location history, and system logs to reconstruct what happened.
