Forensic timelines are chronological records of the events that occur relative to a crime. The timeline can list the relevant events proceeding the crime, all events related to the crime from the initial discovery of the crime to the resolution of the case. They are created by investigators to document the evidence they collect and the steps they take to analyze it.
Although the word “forensic” implies that the technique can be employed only by a crime scene investigator, the most generic meaning of the term forensic simply means that it is suitable for use in a legal proceeding. Hence, anyone with good attention to detail can create a timeline.
Forensic timelines are essential tools for law enforcement, prosecutors, and defense attorneys alike. They can be used to:
- Reconstruct the sequence of events of a crime
- Identify potential suspects
- Corroborate witness statements
- Support or refute a theory of the crime
- Present evidence in court
How to create a forensic timeline
Forensic timelines are typically created using a variety of sources of information, including:
- Witness statements
- Physical evidence
- Chain of Custody documentation
- Crime scene photos and videos
- Laboratory reports
- Medical examiner's reports
- Digital forensic reports
- Court filings
The first step in creating a forensic timeline is to gather as much information as possible about the crime. This includes examining witnesses statements, collecting physical evidence, and reviewing crime scene photos and videos. Once the information has been gathered, the investigator begins to create a timeline of events.
The timeline is typically organized by time, with each event listed in chronological order. A spreadsheet can be very useful to collect the information. It can be useful to have separate columns for the date, time, description of the event, location, people involved, and the source document. This allows the spreadsheet to be sorted or filtered for additional analysis.
Some analysts may find it easiest to work with a single source document at a time and then re-sort the spreadsheet into chronological order. Bates numbering of evidentiary documents makes tracking the source document easy and convenient.
Sometimes two different witnesses may recall a specific event as having happened at a different time. In that case, simply create two different records and notate them as such. Some things occur over a time range; in that case, create a “start” event and a second “end” event. If a timestamp is approximate or an estimate, designate it using a consistent convention such as an italic font.
Obviously, the timeline that is used for the case analysis will have much more detail than the timeline that would be presented to a jury.
The benefits of using forensic timelines
Forensic timelines offer several benefits to investigators, prosecutors, and defense attorneys.
Reconstructing the sequence of events: Forensic timelines can help investigators to reconstruct the sequence of events at a crime scene. This can be helpful in identifying potential suspects and developing a theory of the crime.
Identifying gaps and missing information: Timelines can be used by the analyst to identify chronological gaps and missing information. For example, an affidavit needs to be presented to a judge before the judge will sign a search warrant. A timeline analysis may identify that the affidavit is missing.
Identifying potential suspects: Forensic timelines can also be used to identify potential suspects. For example, if the timeline shows that the suspect was in the area of the crime at the time of the crime, this can be used as evidence to support their arrest.
Corroborate witness statements: Forensic timelines can also be used to corroborate witness statements. For example, if a witness says that they saw the suspect at the crime scene at a certain time, the timeline can be used to verify that this is possible.
Support or refute a theory of a crime: Forensic timelines can also be used to support or refute a theory of the crime. For example, if the timeline shows that the suspect was in a different location at the time of the crime, this can be used to refute the theory that the suspect committed the crime.
Presenting evidence in court: Forensic timelines can also be used to present evidence in court. For example, an investigator may use a timeline to show the jury how the suspect committed the crime.
Digital Forensic Timelines
A special type of timeline is a Digital Forensic Timeline. Devices such as computers and mobile phones create thousands of records of timestamped data. This includes geo-location data based on GPS or cell tower records. It also includes system events, such as when the system was unlocked by the user.
In 2012, Rob Lee, the Curriculum Director at SANS Institute, developed a technique for colorizing system timelines using the conditional formatting feature of Microsoft Excel. See https://www.sans.org/blog/digital-forensic-sifting-colorized-super-timeline-template-for-log2timeline-output-files/
Lucid Truth Technologies recently used this technique to reconstruct the events occurring on an iPhone immediately preceding a fatal car crash in a distracted driving case.
Conclusion
Forensic timelines are essential tools for law enforcement and prosecutors. They can be used to solve crimes, identify suspects, and present evidence in court. Forensic timeline analysis is a valuable technique, and new technologies are being developed to make it even more powerful.
Future of Forensic Timeline Analysis
New technologies are being developed to make forensic timeline analysis more efficient and accurate. At Lucid Truth Technologies, we use natural language processing (NLP) and artificial intelligence (AI) tools to analyze large amounts of data and identify patterns that would be difficult for humans to see.
As AI technology continues to develop, it is likely that forensic timeline analysis will become even more sophisticated. This will allow investigators to solve crimes more quickly and efficiently.
If you think that a forensic timeline will aid your case, contact us today.
