Create investigation timelines with the collected evidence to gain insight into the context of an incident.
The following table outlines the actions available in the Timeline screen.
|
Action
|
Description
|
|
Filter timeline elements
|
Use the dropdown lists and specify the operating system to locate
specific timeline entries.
|
|
Add a custom element to the timeline
|
Click the Add Element icon (
 ) and follow the instructions on screen to add a custom element to the timeline. |
|
Delete elements from the timeline
|
Select one or more elements from the timeline and then click Delete Selected.
|
|
Reset timeline
|
Click the options icon (
 ) and select Delete All to delete all elements from a timeline. |
|
Add timeline to sub case
|
Click the options icon (
) and select Add
Timeline to Case to add the current timeline to the
specified Forensics sub-case. |