Timeline
With Timeline, Belkasoft X combines all artifacts with timestamps—chats, emails, documents, pictures, and others—in your case and presents them in a defined order. Timeline allows you to review all activities or events that occurred around specific periods on one or more devices.
If you do not see Timeline window, you can open it by clicking on Timeline main menu item.
To update the Timeline contents (anytime), click on the refresh icon.
Timeline’s view
To select a view—Timeline or List—click on the option at the top-right corner. Timeline (graph) view has 2 display modes: with categories and colored bars. To switch between modes, use the keyboard shortcuts ctrl + q / w. The default mode is with colored bars (ctrl + w).
You can also select a theme: light / dark using the keyboard shortcut ctrl + t.
Within the context menu are shown the first 20 events that fall into the selected time point. After you select an event from the drop-down list, you can navigate to this item on the Structure or Overview tabs.
The time interval can be changed by selecting the required area in the values area (top of the window) or in the overview area (bottom of the window). A double click removes the filter.
List view. When the list view is selected, you can go through artifacts arranged based on time. When you click on an artifact, Belkasoft X presents its attributes under the Properties pane on the right.
As other lists, Timeline item list has a checkbox column for operations with multiple checked items (such as a report creation), allows for sorting by clicking on a column header, filtering, customizing column set and so on.
Context menu of Timeline item list has the same items as other lists, but there is also one command, which is not yet described: Go to original item. This command navigates you to the item, which originated the selected Timeline item. Say for a "message sent" event, it will open Artifacts Structure, select corresponding chats profile and corresponding message in the list.
Note that some artifacts may be listed multiple times inside this window. For example, each file-based artifact (such as a document) has various operating system times, e.g. Created or Last access time. Besides, artifacts having metadata (such as a picture) may have various events recorded inside, e.g. "GPS time for shot" or "Date/time digitized". Each such time will result in a separate entry in Timeline (Grid view), which is why total amount of artifacts shown in Artifacts Structure typically does not match with the number of items in Timeline item list.
Usually Timeline contains a huge number of elements, so you may want to filter it by time span or types of events to show, for instance, only emails sent or received, or only computer boot times. For more information on this, see "Filtering data lists".
Difference between Local Time and Time (UTC)
Belkasoft X displays time values for artifacts under both Local Time and Time (UTC).
When an artifact is stored used local time, Belkasoft X uses the value to calculate UTC time (based on the time zone settings you defined). When a data source uses a time zone that differs from that in the case, Belkasoft X uses the data source time zone.