Data - Timeline

Timeline section aggregates all extracted items that contain time and date information and shows them again in chronological order.

Creation and modification time of files and folders extracted from the phone are excluded from the timeline because there is a lot of systems generated files and such information is not forensically interesting.

All data that you want to be shown in the timeline must be marked for extraction in its specific section. If you want a timeline to include messages, for example, you have to check the Messages section to be extracted.

Generate timeline

Turns the timeline on and off

Order by time

Here you can choose if events are flowing naturally - Ascending or in reverse order - Descending

Filter by time

Choose the start and end interval of events you want to have in the timeline.

Selected items

You can specify which type of items you want to appear in the timeline.

Timeline data may contain for example:

• Creation and modification times of contacts.

• Times when a given message was sent or received.

• Time when a given call was made.

• Time when a given event from organizer was created or modified

• Time when a given event from organizer starts or ends.

• Time when a task in an organizer was created, modified or completed.

• Time when a given image/recording/video was created or edited.

• Time when a given web page was visited.

• Time when a user searched for a given query in a web browser.

• Time when a given bookmark was created or modified.

• Time when the user logged in for last time in a given application.

• Last time when the device was connected to a given Wi-Fi network.

• Time when a given application was installed.

• Time when a given place was visited.

• Time when a given notification was created.

• Time when a given sport session from fitness application started or ended.

• Time when a given QR code was scanned.

• and plenty more.

Example of timeline report