Timeline-Analyse & Event-Korrelation: Methodische Rekonstruktion forensischer Ereignisse

Timeline-Analyse bildet das Rückgrat moderner forensischer Untersuchungen und ermöglicht die chronologische Rekonstruktion von Ereignissen aus heterogenen digitalen Artefakten. Diese methodische Herangehensweise korreliert zeitbasierte Evidenz für präzise Incident-Response und belastbare Beweisführung.

Grundlagen der forensischen Timeline-Analyse

Was ist Timeline-Analyse?

Timeline-Analyse ist die systematische Korrelation zeitbasierter Artefakte aus verschiedenen digitalen Quellen zur Rekonstruktion von Ereignissequenzen. Sie ermöglicht Forensikern, das “Was”, “Wann”, “Wo” und “Wie” von Sicherheitsvorfällen zu verstehen.

Kernprinzipien:

• Chronologische Ordnung: Alle Ereignisse werden in temporaler Reihenfolge arrangiert
• Multi-Source-Integration: Daten aus verschiedenen Systemen werden vereint
• Zeitstempel-Normalisierung: UTC-Konvertierung für einheitliche Referenz
• Korrelationsbasierte Analyse: Zusammenhänge zwischen scheinbar unabhängigen Events

Typologie forensischer Zeitstempel

MAC-Times (Modified, Accessed, Created)

Filesystem-Timestamps:
- $STANDARD_INFORMATION (SI) - NTFS-Metadaten
- $FILE_NAME (FN) - Directory-Entry-Timestamps  
- Born Date - Erste Erstellung im Filesystem
- $USNJrnl - Change Journal Entries

Registry-Timestamps

Windows Registry:
- Key Last Write Time - Letzte Modifikation
- Value Creation Time - Wert-Erstellung
- Hive Load Time - Registry-Hive-Mounting

Event-Log-Timestamps

Windows Event Logs:
- TimeCreated - Event-Generierung
- TimeWritten - Log-Persistierung  
- CorrelationActivityID - Cross-System-Tracking

Super-Timeline-Erstellung: Methodisches Vorgehen

Phase 1: Artefakt-Akquisition und Preprocessing

Datenquellen-Inventar erstellen:

# Filesystem-Timeline mit fls
fls -r -p -m /mnt/evidence/image.dd > filesystem_timeline.body

# Registry-Timeline mit regtime
regtime.py -r /mnt/evidence/registry/ > registry_timeline.csv

# Event-Log-Extraktion mit python-evtx
evtx_dump.py Security.evtx > security_events.xml

Memory-Artefakte integrieren:

# Volatility Timeline-Generierung
vol.py -f memory.vmem --profile=Win10x64 timeliner > memory_timeline.csv

# Process-Timeline mit detailed Metadata
vol.py -f memory.vmem --profile=Win10x64 pslist -v > process_details.txt

Phase 2: Zeitstempel-Normalisierung und UTC-Konvertierung

Timezone-Handling:

# Python-Script für Timezone-Normalisierung
import datetime
import pytz

def normalize_timestamp(timestamp_str, source_timezone):
    """
    Konvertiert lokale Timestamps zu UTC für einheitliche Timeline
    """
    local_tz = pytz.timezone(source_timezone)
    dt = datetime.datetime.strptime(timestamp_str, '%Y-%m-%d %H:%M:%S')
    localized_dt = local_tz.localize(dt)
    utc_dt = localized_dt.astimezone(pytz.utc)
    return utc_dt.strftime('%Y-%m-%d %H:%M:%S UTC')

Anti-Timestomp-Detection:

# Timestomp-Anomalien identifizieren
analyzeMFT.py -f $MFT -o mft_analysis.csv
# Suche nach: SI-Time < FN-Time (Timestomp-Indikator)

Phase 3: Log2timeline/PLASO Super-Timeline-Processing

PLASO-basierte Timeline-Generierung:

# Multi-Source-Timeline mit log2timeline
log2timeline.py --storage-file evidence.plaso \
    --parsers "win7,chrome,firefox,skype" \
    --timezone "Europe/Berlin" \
    /mnt/evidence/

# CSV-Export für Analysis
psort.py -w timeline_super.csv evidence.plaso

Advanced PLASO-Filtering:

# Zeitfenster-spezifische Extraktion
psort.py -w incident_window.csv \
    --date-filter "2024-01-10,2024-01-12" \
    evidence.plaso

# Ereignis-spezifisches Filtering
psort.py -w web_activity.csv \
    --filter "parser contains 'chrome'" \
    evidence.plaso

Advanced Correlation-Techniken

Pivot-Point-Identifikation

Initial Compromise Detection:

-- SQL-basierte Timeline-Analyse (bei CSV-Import in DB)
SELECT timestamp, source, event_type, description
FROM timeline 
WHERE description LIKE '%powershell%' 
   OR description LIKE '%cmd.exe%'
   OR description LIKE '%rundll32%'
ORDER BY timestamp;

Lateral Movement Patterns:

# Python-Script für Lateral-Movement-Detection
def detect_lateral_movement(timeline_data):
    """
    Identifiziert suspicious Login-Patterns über Zeitfenster
    """
    login_events = timeline_data[
        timeline_data['event_type'].str.contains('4624|4625', na=False)
    ]
    
    # Gruppierung nach Source-IP und Zeitfenster-Analyse
    suspicious_logins = login_events.groupby(['source_ip']).apply(
        lambda x: len(x[x['timestamp'].diff().dt.seconds < 300]) > 5
    )
    
    return suspicious_logins[suspicious_logins == True]

Behavioral Pattern Recognition

User Activity Profiling:

# Regelmäßige Aktivitätsmuster extrahieren
grep -E "(explorer\.exe|chrome\.exe|outlook\.exe)" timeline.csv | \
awk -F',' '{print substr($1,1,10), $3}' | \
sort | uniq -c | sort -nr

Anomalie-Detection durch Statistical Analysis:

import pandas as pd
from scipy import stats

def detect_activity_anomalies(timeline_df):
    """
    Identifiziert ungewöhnliche Aktivitätsmuster via Z-Score
    """
    # Aktivität pro Stunde aggregieren
    timeline_df['hour'] = pd.to_datetime(timeline_df['timestamp']).dt.hour
    hourly_activity = timeline_df.groupby('hour').size()
    
    # Z-Score Berechnung für Anomalie-Detection
    z_scores = stats.zscore(hourly_activity)
    anomalous_hours = hourly_activity[abs(z_scores) > 2]
    
    return anomalous_hours

Network-Event-Korrelation

Cross-System Timeline Correlation

SIEM-Integration für Multi-Host-Korrelation:

# Splunk-Query für korrelierte Events
index=windows EventCode=4624 OR EventCode=4625 OR EventCode=4648
| eval login_time=strftime(_time, "%Y-%m-%d %H:%M:%S")
| stats values(EventCode) as event_codes by src_ip, login_time
| where mvcount(event_codes) > 1

Network Flow Timeline Integration:

# Zeek/Bro-Logs mit Filesystem-Timeline korrelieren
def correlate_network_filesystem(conn_logs, file_timeline):
    """
    Korreliert Netzwerk-Connections mit File-Access-Patterns
    """
    # Zeitfenster-basierte Korrelation (±30 Sekunden)
    correlations = []
    
    for _, conn in conn_logs.iterrows():
        conn_time = pd.to_datetime(conn['ts'])
        time_window = pd.Timedelta(seconds=30)
        
        related_files = file_timeline[
            (pd.to_datetime(file_timeline['timestamp']) >= conn_time - time_window) &
            (pd.to_datetime(file_timeline['timestamp']) <= conn_time + time_window)
        ]
        
        if not related_files.empty:
            correlations.append({
                'connection': conn,
                'related_files': related_files,
                'correlation_strength': len(related_files)
            })
    
    return correlations

Anti-Forensik-Detection durch Timeline-Inkonsistenzen

Timestamp Manipulation Detection

Timestomp-Pattern-Analyse:

# MFT-Analyse für Timestomp-Detection
analyzeMFT.py -f \$MFT -o mft_full.csv

# Suspekte Timestamp-Patterns identifizieren
python3 << EOF
import pandas as pd
import numpy as np

mft_data = pd.read_csv('mft_full.csv')

# Pattern 1: SI-Time vor FN-Time (klassischer Timestomp)
timestomp_candidates = mft_data[
    pd.to_datetime(mft_data['SI_Modified']) < pd.to_datetime(mft_data['FN_Modified'])
]

# Pattern 2: Unrealistische Timestamps (z.B. 1980-01-01)
epoch_anomalies = mft_data[
    pd.to_datetime(mft_data['SI_Created']).dt.year < 1990
]

print(f"Potential Timestomp: {len(timestomp_candidates)} files")
print(f"Epoch Anomalies: {len(epoch_anomalies)} files")
EOF

Event Log Manipulation Detection

Windows Event Log Gap Analysis:

def detect_log_gaps(event_log_df):
    """
    Identifiziert verdächtige Lücken in Event-Log-Sequenzen
    """
    # Event-Record-IDs sollten sequenziell sein
    event_log_df['RecordNumber'] = pd.to_numeric(event_log_df['RecordNumber'])
    event_log_df = event_log_df.sort_values('RecordNumber')
    
    # Gaps in Record-Sequenz finden
    record_diffs = event_log_df['RecordNumber'].diff()
    large_gaps = record_diffs[record_diffs > 100]  # Threshold anpassbar
    
    return large_gaps

Automated Timeline Processing & ML-basierte Anomalie-Erkennung

Machine Learning für Pattern Recognition

Unsupervised Clustering für Event-Gruppierung:

from sklearn.cluster import DBSCAN
from sklearn.feature_extraction.text import TfidfVectorizer
import pandas as pd

def cluster_timeline_events(timeline_df):
    """
    Gruppiert ähnliche Events via DBSCAN-Clustering
    """
    # TF-IDF für Event-Descriptions
    vectorizer = TfidfVectorizer(max_features=1000, stop_words='english')
    event_vectors = vectorizer.fit_transform(timeline_df['description'])
    
    # DBSCAN-Clustering
    clustering = DBSCAN(eps=0.5, min_samples=5).fit(event_vectors.toarray())
    timeline_df['cluster'] = clustering.labels_
    
    # Anomalie-Events (Cluster -1)
    anomalous_events = timeline_df[timeline_df['cluster'] == -1]
    
    return timeline_df, anomalous_events

Time-Series-Anomalie-Detection:

from sklearn.ensemble import IsolationForest
import matplotlib.pyplot as plt

def detect_temporal_anomalies(timeline_df):
    """
    Isolation Forest für zeitbasierte Anomalie-Detection
    """
    # Stündliche Aktivität aggregieren
    timeline_df['timestamp'] = pd.to_datetime(timeline_df['timestamp'])
    hourly_activity = timeline_df.groupby(
        timeline_df['timestamp'].dt.floor('H')
    ).size().reset_index(name='event_count')
    
    # Isolation Forest Training
    iso_forest = IsolationForest(contamination=0.1)
    anomaly_labels = iso_forest.fit_predict(
        hourly_activity[['event_count']]
    )
    
    # Anomale Zeitfenster identifizieren
    hourly_activity['anomaly'] = anomaly_labels
    anomalous_periods = hourly_activity[hourly_activity['anomaly'] == -1]
    
    return anomalous_periods

Enterprise-Scale Timeline Processing

Distributed Processing für große Datasets

Apache Spark für Big-Data-Timeline-Analyse:

from pyspark.sql import SparkSession
from pyspark.sql.functions import *

def process_enterprise_timeline(spark_session, timeline_path):
    """
    Spark-basierte Verarbeitung für TB-große Timeline-Daten
    """
    # Timeline-Daten laden
    timeline_df = spark_session.read.csv(
        timeline_path, 
        header=True, 
        inferSchema=True
    )
    
    # Zeitfenster-basierte Aggregation
    windowed_activity = timeline_df \
        .withColumn("timestamp", to_timestamp("timestamp")) \
        .withColumn("hour_window", window("timestamp", "1 hour")) \
        .groupBy("hour_window", "source_system") \
        .agg(
            count("*").alias("event_count"),
            countDistinct("user").alias("unique_users"),
            collect_set("event_type").alias("event_types")
        )
    
    return windowed_activity

Cloud-Forensics Timeline Integration

AWS CloudTrail Timeline Correlation:

# CloudTrail-Events mit lokaler Timeline korrelieren
aws logs filter-log-events \
    --log-group-name CloudTrail \
    --start-time 1642636800000 \
    --end-time 1642723200000 \
    --filter-pattern "{ $.eventName = \"AssumeRole\" }" \
    --output json > cloudtrail_events.json

# JSON zu CSV für Timeline-Integration
jq -r '.events[] | [.eventTime, .sourceIPAddress, .eventName, .userIdentity.type] | @csv' \
    cloudtrail_events.json > cloudtrail_timeline.csv

Praktische Anwendungsszenarien

Szenario 1: Advanced Persistent Threat (APT) Investigation

Mehrstufige Timeline-Analyse:

1. Initial Compromise Detection:

# Web-Browser-Downloads mit Malware-Signaturen korrelieren
grep -E "(\.exe|\.zip|\.pdf)" browser_downloads.csv | \
while read line; do
    timestamp=$(echo $line | cut -d',' -f1)
    filename=$(echo $line | cut -d',' -f3)
    
    # Hash-Verification gegen IOC-Liste
    sha256=$(sha256sum "/mnt/evidence/$filename" 2>/dev/null | cut -d' ' -f1)
    grep -q "$sha256" ioc_hashes.txt && echo "IOC Match: $timestamp - $filename"
done

2. Lateral Movement Tracking:

-- Cross-System-Bewegung via RDP/SMB
SELECT t1.timestamp, t1.source_ip, t2.timestamp, t2.dest_ip
FROM network_timeline t1
JOIN filesystem_timeline t2 ON 
    t2.timestamp BETWEEN t1.timestamp AND t1.timestamp + INTERVAL 5 MINUTE
WHERE t1.protocol = 'RDP' AND t2.activity_type = 'file_creation'
ORDER BY t1.timestamp;

Szenario 2: Insider-Threat-Analyse

Behavioral Baseline vs. Anomalie-Detection:

def analyze_insider_threat(user_timeline, baseline_days=30):
    """
    Vergleicht User-Aktivität mit historischer Baseline
    """
    # Baseline-Zeitraum definieren
    baseline_end = pd.to_datetime('2024-01-01')
    baseline_start = baseline_end - pd.Timedelta(days=baseline_days)
    
    baseline_activity = user_timeline[
        (user_timeline['timestamp'] >= baseline_start) &
        (user_timeline['timestamp'] <= baseline_end)
    ]
    
    # Anomale Aktivitätsmuster
    analysis_period = user_timeline[
        user_timeline['timestamp'] > baseline_end
    ]
    
    # Metriken: Off-Hours-Activity, Data-Volume, Access-Patterns
    baseline_metrics = calculate_user_metrics(baseline_activity)
    current_metrics = calculate_user_metrics(analysis_period)
    
    anomaly_score = compare_metrics(baseline_metrics, current_metrics)
    
    return anomaly_score

Herausforderungen und Lösungsansätze

Challenge 1: Timezone-Komplexität in Multi-Domain-Umgebungen

Problem: Inkonsistente Timezones zwischen Systemen führen zu falschen Korrelationen.

Lösung:

def unified_timezone_conversion(timeline_entries):
    """
    Intelligente Timezone-Detection und UTC-Normalisierung
    """
    timezone_mapping = {
        'windows_local': 'Europe/Berlin',
        'unix_utc': 'UTC',
        'web_browser': 'client_timezone'  # Aus Browser-Metadaten
    }
    
    for entry in timeline_entries:
        source_tz = detect_timezone_from_source(entry['source'])
        entry['timestamp_utc'] = convert_to_utc(
            entry['timestamp'], 
            timezone_mapping.get(source_tz, 'UTC')
        )
    
    return timeline_entries

Challenge 2: Volume-Skalierung bei Enterprise-Investigations

Problem: TB-große Timeline-Daten überschreiten Memory-Kapazitäten.

Lösung - Streaming-basierte Verarbeitung:

def stream_process_timeline(file_path, chunk_size=10000):
    """
    Memory-effiziente Timeline-Processing via Chunks
    """
    for chunk in pd.read_csv(file_path, chunksize=chunk_size):
        # Chunk-weise Verarbeitung
        processed_chunk = apply_timeline_analysis(chunk)
        
        # Streaming-Output zu aggregated Results
        yield processed_chunk

Challenge 3: Anti-Forensik und Timeline-Manipulation

Problem: Adversaries manipulieren Timestamps zur Evidence-Destruction.

Lösung - Multi-Source-Validation:

# Cross-Reference-Validation zwischen verschiedenen Timestamp-Quellen
python3 << EOF
# $MFT vs. $UsnJrnl vs. Event-Logs vs. Registry
def validate_timestamp_integrity(file_path):
    sources = {
        'mft_si': get_mft_si_time(file_path),
        'mft_fn': get_mft_fn_time(file_path), 
        'usnjrnl': get_usnjrnl_time(file_path),
        'prefetch': get_prefetch_time(file_path),
        'eventlog': get_eventlog_time(file_path)
    }
    
    # Timestamp-Inkonsistenzen identifizieren
    inconsistencies = detect_timestamp_discrepancies(sources)
    confidence_score = calculate_integrity_confidence(sources)
    
    return inconsistencies, confidence_score
EOF

Tool-Integration und Workflow-Optimierung

Timeline-Tool-Ecosystem

Core-Tools-Integration:

#!/bin/bash
# Comprehensive Timeline-Workflow-Automation

# 1. Multi-Source-Acquisition
log2timeline.py --storage-file case.plaso \
    --parsers "win7,chrome,firefox,apache,nginx" \
    --hashers "sha256" \
    /mnt/evidence/

# 2. Memory-Timeline-Integration  
volatility -f memory.vmem --profile=Win10x64 timeliner \
    --output=csv --output-file=memory_timeline.csv

# 3. Network-Timeline-Addition
zeek -r network.pcap Log::default_path=/tmp/zeek_logs/
python3 zeek_to_timeline.py /tmp/zeek_logs/ > network_timeline.csv

# 4. Timeline-Merge und Analysis
psort.py -w comprehensive_timeline.csv case.plaso
python3 merge_timelines.py comprehensive_timeline.csv \
    memory_timeline.csv network_timeline.csv > unified_timeline.csv

# 5. Advanced-Analysis-Pipeline
python3 timeline_analyzer.py unified_timeline.csv \
    --detect-anomalies --pivot-analysis --correlation-strength=0.7

Autopsy Timeline-Viewer Integration

Autopsy-Import für Visual Timeline Analysis:

def export_autopsy_timeline(timeline_df, case_name):
    """
    Konvertiert Timeline zu Autopsy-kompatiblem Format
    """
    autopsy_format = timeline_df[['timestamp', 'source', 'event_type', 'description']].copy()
    autopsy_format['timestamp'] = pd.to_datetime(autopsy_format['timestamp']).astype(int) // 10**9
    
    # Autopsy-CSV-Format
    autopsy_format.to_csv(f"{case_name}_autopsy_timeline.csv", 
                         columns=['timestamp', 'source', 'event_type', 'description'],
                         index=False)

Fazit und Best Practices

Timeline-Analyse repräsentiert eine fundamentale Investigationstechnik, die bei korrekter Anwendung präzise Incident-Rekonstruktion ermöglicht. Die Kombination aus methodischer Multi-Source-Integration, Advanced-Correlation-Techniken und ML-basierter Anomalie-Detection bildet die Basis für moderne forensische Untersuchungen.

Key Success Factors:

1. Systematic Approach: Strukturierte Herangehensweise von Akquisition bis Analysis
2. Multi-Source-Validation: Cross-Reference zwischen verschiedenen Artefakt-Typen
3. Timezone-Awareness: Konsistente UTC-Normalisierung für akkurate Korrelation
4. Anti-Forensik-Resistenz: Detection von Timestamp-Manipulation und Evidence-Destruction
5. Scalability-Design: Enterprise-fähige Processing-Pipelines für Big-Data-Szenarien

Die kontinuierliche Weiterentwicklung von Adversary-Techniken erfordert adaptive Timeline-Methoden, die sowohl traditionelle Artefakte als auch moderne Cloud- und Container-Umgebungen erfassen. Die Integration von Machine Learning in Timeline-Workflows eröffnet neue Möglichkeiten für automatisierte Anomalie-Detection und Pattern-Recognition bei gleichzeitiger Reduktion des manuellen Aufwands.

Nächste Schritte:

• Vertiefung spezifischer Tool-Implementierungen (Autopsy, SIFT, etc.)
• Cloud-native Timeline-Techniken für AWS/Azure-Umgebungen
• Advanced Correlation-Algorithmen für Zero-Day-Detection
• Integration von Threat-Intelligence in Timeline-Workflows