Data - Timeline

Data - Timeline





Timeline section aggregates all extracted items that contain time and date information and shows them agian in chronological order. Exact parameters of generated timeline can be configured here.

Creation and modification time of files and folders extracted from the phone are excluded from the timeline, because there is a lot of system generated files and such information is not forensically interesting.

All data that you want to be shown in the timeline must be marked for extraction in its specific section. If you want timeline to include messages for example, you have to check Messages section to be extracted.


Generate timeline

Turns the timeline on and off

Order by time

Here you can choose if events are flowing naturally - Ascending or in reverse order - Descending

Filter by time

Choose start and end interval of events you want to have in the timeline.

Selected items

You can specify which type of items you want to appear in the timeline.

Timeline data may contain for example:

  • Creation and modification times of contacts.
  • Times when a given message was sent or received.
  • Time when a given call was made.
  • Time when a given event from organizer was created or modified
  • Time when a given event from organizer starts or ends.
  • Time when a task in organizer was created, modified or completed.
  • Time when a given image/recording/video was created or edited.
  • Time when a given web page was visited.
  • Time when a user searched for given query in web browser.
  • Time when a given bookmark was created or modified.
  • Time when the user logged in for last time in given application.
  • Last time when the device was connected to given Wi-Fi network.
  • Time when a given application was installed.
  • Time when a given place was visited.
  • Time when a given notification was created.
  • Time when a given sport session from fitness application started or ended.
  • Time when a given QR code was scanned.
  • and plenty more.

Example of timeline report:




    • Related Articles

    • Data - Deleted data

      We do offer more ways to recover deleted data. The first one is recovering the data from SQLite databases, the second one is recovering the files and folders from physical images. SQL databases allow you to recover the data which were marked as ...

    • Data - data extraction log

      Following tab displays information about ongoing extraction: if you select the Data Extraction Log option in the Specific selection, you will get a brief resume of the extraction tab in your report as well:

    • Data - SIM card

      Extracts data from the SIM card such as IMSI, Country, ICCID, and Operator as shown below:

    • Data - Filesystems

      Full FileSystem - if this option is selected then all files from the phone will be copied, and will be included within the list in the report. Please note that this might analysis may take a long time and can consume a considerable disk space, ...

    • Import data

      Data does not always need to be extracted directly from a live connected device. It is also possible to load one of several available backup formats or other compatible file types, and process their content in the same fashion as if the physical ...