Build an OSINT timeline that separates events, publications and unknowns.

Step-by-step method

A reproducible path from question to conclusion.

1. 1

   Define the time question

   Set the period, event to explain and useful granularity. A crisis lasting hours and a company history need different precision.

2. 2

   Create core fields

   Separate event, publication, update and consultation dates, time zone, source and confidence for every item.

3. 3

   Preserve original meaning

   Summarise without removing source caveats. Keep a short excerpt or contextual copy that supports review.

4. 4

   Normalise without inventing

   Convert times to a chosen zone, mark approximate dates and never turn a vague period into a precise instant.

5. 5

   Test competing sequences

   Place contradictions side by side, identify source dependence and look for events that should exist if a hypothesis were true.

6. 6

   Write the decision reading

   Identify what precedes what, uncertainty windows, turning points and checks that could change the order or conclusion.

One source often contains several dates

A displayed date may describe publication, last modification or the reported event. Metadata, archives and syndication may reveal a different sequence.

Record what each date means. Apparent precision without definition creates a misleading timeline.

Expose time zones and uncertainty

Use a stable format, retain the original zone and state conversion. Do not force a date-only item before or after an event with an exact time.

Intervals, “before”, “no later than” and “between” should remain visible. Unknowns are methodological information, not defects to hide.

Compare hypotheses against sequence

A timeline tests causality without assuming it. One event preceding another does not prove that it caused it.

Mark sources copying each other. Five successive articles may all derive from one report and are not five confirmations.

Common pitfalls

Four shortcuts that weaken the result.