Create investigation timelines with the collected evidence to gain insight into the context of an incident.
The following table outlines the actions available in the Timeline screen.
Action
|
Description
|
Filter timeline elements
|
Specify the operating system to locate specific timeline entries.
|
Add a custom element to the timeline
|
Click Add Element (
![]() |
Delete elements from the timeline
|
Select one or more elements from the timeline and then click Delete Selected.
|
Reset timeline
|
Click
![]() |
Add timeline to sub-case
|
Click
![]() |