Gold Standard · Intelligence specialist guide
Find the nearest question, then follow the evidence
A timeline is not a decorated list of dates. It is a structured model of what happened, what was reported, what remains uncertain and which competing explanations survive the sequence.
Analysts often receive fragments: a message with an unreliable clock, a witness who remembers order but not time, a system log in another time zone and a later summary that repeats an earlier report. Placed in one list, those fragments can look more certain and independent than they are. A useful timeline protects the difference between an event and the evidence about that event.
This guide treats timeline analysis as a structured analytic method. It defines the question and temporal scope, preserves event time and report time, grades time precision, maps source dependencies, marks evidence gaps and tests alternative sequences. It also draws a firm boundary: temporal order constrains explanations, but “before” does not by itself mean “because of”.
Choose a reading route
Build the time model
Question, events, reports and clocks.ROUTE 2 · CHAPTERS 4–5
Control precision
Intervals, granularity and meaningful gaps.ROUTE 3 · CHAPTERS 6–7
Work the case
Reconstruct and compare possible sequences.ROUTE 4 · CHAPTERS 8–10
Test inference
Causality, source dependence and updates.ROUTE 5 · CHAPTERS 11–12
Transfer and audit
Incident review, warnings and governance.
Open the full chapter index · Use the field check · Return to the Intelligence root
Chapter contents
Chapters 1–3 · Temporal frame and evidence types
Chapters 4–6 · Precision, gaps and reconstruction
Chapters 7–9 · Inference, dependencies and revision
Chapters 10–12 · Transfer, warning and audit
CHAPTER 1 OF 12 · Build the time model
1. Start with a temporal intelligence question
A timeline becomes useful when it answers a defined question. “What happened?” is usually too broad. “Which actions occurred before the service interruption, which were known to the operator, and which sequence is consistent with the available records?” identifies events, decision relevance and the boundary of analysis. Without that frame, a timeline grows into an archive of adjacent facts.
Write the focal outcome, start and end boundaries, units of time, actors, locations and decisions the reconstruction must support. State what would count as an event and what belongs only in background. Keep a parking area for material that may matter later but is outside the present temporal claim. Record the cutoff time after which new evidence will appear as an update rather than being silently folded into the first version.
A fictional school network experiences a six-minute outage during online assessment. The useful question is not the history of the network. It is whether configuration change, traffic surge or equipment fault can explain the sequence visible between the last known healthy state and stable recovery.
Changed-context transfer check
Transfer the frame to a delayed supply shipment. Choose whether the question concerns physical movement, decisions, communications or all three, and justify the temporal boundary.
Limit and misconception
A narrow question can omit a relevant precursor. A broad question can drown the mechanism in detail. The scope should be revisable, with every change recorded.
Evidence practice
Keep the focal outcome, time boundary, event definition and analytic cutoff. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: collecting every dated item before deciding which temporal uncertainty matters. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
CHAPTER 2 OF 12 · Build the time model
2. Separate events, observations, records and later reports
An event is something asserted to have occurred. An observation is a person or system registering something. A record is the stored trace. A report is a communication about the event, observation or record. These can have different times and different uncertainties. Collapsing them into one timestamp makes hearsay look simultaneous with action and can reverse apparent order.
Give each entry fields for asserted event time, observation time, record creation time, report time, source, source-of-source, location, actor, confidence and precision. Preserve the original wording before normalising it. If a report says “about ten minutes earlier”, keep the relative expression and the anchor used to calculate an interval. Never substitute the analyst’s estimate without labelling it.
A witness sends a message at 10:24 saying the screen froze “about five minutes ago”. The message time is exact to the platform log; the event time is an interval around 10:19. A later incident report written at 16:00 repeats the message. These are three records of one possible event, not three independent freezes.
Changed-context transfer check
Apply the four-layer model to a medical handover or maintenance call in which the first written record appears long after the observed condition.
Limit and misconception
Some systems create records automatically at event time; others batch, buffer or backfill them. A timestamp field name does not establish which clock it represents.
Evidence practice
Keep a source-linked event table preserving original and normalised times. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: using document creation time as the event time or counting repeated reports as separate events. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 3 OF 12 · Build the time model
3. Reconcile time zones, clock drift and asynchronous systems
Two accurate-looking timestamps can disagree because clocks use different zones, drift at different rates, round to different precision or record receipt rather than occurrence. Distributed systems add buffering and network delay. Timeline analysis must therefore preserve original clock values and document every conversion into the common analytic time base.
For each source, record time zone, daylight-saving rule where relevant, clock authority, synchronization status, timestamp precision and known offset. Convert into a common representation while retaining the original. Estimate uncertainty intervals for drift and transport delay. Use anchor events visible in multiple systems to test whether a constant or changing offset explains the differences.
A router log is seven minutes fast, an application log uses Coordinated Universal Time and a staff message shows Singapore time. After normalization, the apparent order of a restart and an alarm changes. The corrected order removes one explanation that required the alarm to precede the restart.
Changed-context transfer check
Transfer the procedure to video, badge-access and telephone records from three organizations. Identify which conversions are known and which remain assumptions.
Limit and misconception
Clock alignment can improve order without proving identity between events. Similar timestamps from two sources may still refer to different actions.
Evidence practice
Keep a clock register, conversion formula, uncertainty range and anchor-event test. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: sorting raw timestamp strings and treating the resulting order as ground truth. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 4 OF 12 · Control precision
4. Represent intervals and granularity instead of false exactness
Not every event belongs at second-level precision. A witness may know that a vehicle arrived after lunch; a batch log may identify only a five-minute window; a document may be signed on one date with no reliable time of day. Assigning an exact midpoint makes the display neat while inventing evidence.
Store earliest and latest plausible times, the basis for the interval and a precision class. Use partial-order relationships such as before, after or overlaps when clock time is unavailable. Visualise uncertainty bands rather than one point. When two intervals overlap, report order as unresolved unless another constraint separates them.
One source places a configuration change between 10:10 and 10:20. Another places the first error between 10:17 and 10:19. The evidence cannot establish whether the change preceded every error, though it can exclude a change after 10:20. The honest timeline narrows possibilities without forcing a total order.
Changed-context transfer check
Build an interval timeline for a historical incident using dated letters, travel time and one precisely timestamped receipt.
Limit and misconception
Greater timestamp precision does not guarantee greater event accuracy. A system can record the wrong event at microsecond resolution.
Evidence practice
Keep time intervals, partial-order constraints and precision provenance. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: replacing uncertain intervals with exact points to make the chart sortable. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 5 OF 12 · Control precision
5. Treat gaps as questions, not automatic evidence of absence
A blank period may mean nothing happened, nothing was observed, records were lost, collection was not active or the event left no trace in that source. Negative evidence becomes informative only when the source was capable, expected and sufficiently sensitive to record the event during the relevant period.
For each meaningful gap, ask whether collection was operating, coverage included the actor or place, detection probability was adequate, retention was intact and the event should have generated a trace. Compare independent collection routes. Label the gap as observed absence, collection absence, missing record or unresolved. Turn critical gaps into focused collection requirements.
A badge system shows no entry by a technician, but the side door was not instrumented. The record cannot support “the technician did not enter”. By contrast, synchronized video at every entrance with verified continuous coverage would make the absence more diagnostic, while still requiring identity and visibility checks.
Changed-context transfer check
Apply the test to a financial ledger with a missing transaction and a sensor network with a communications outage. Explain why the same blank means different things.
Limit and misconception
Absence-of-evidence reasoning depends on an explicit detection model. It should not be used to erase testimony or infer intent from silence.
Evidence practice
Keep a gap register with collection capability, expected trace and alternative causes. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: treating every unrecorded event as proof that the event did not occur. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 6 OF 12 · Work the case
6. Worked example: reconstruct a fictional service outage
A fictional learning platform fails during an assessment. Candidate explanations are a bad configuration deployment, an external traffic surge and a storage fault. Evidence includes deployment logs, application errors, network counters, staff messages and a later incident summary. Several clocks disagree and the summary repeats earlier observations.
The analyst first separates events from reports, normalizes clocks and assigns intervals. The deployment completed before the first verified error, but network counters rose only after errors began. Storage latency increased within the same interval as the first errors. The sequence weakens a traffic-surge-first explanation but does not yet distinguish configuration from storage fault because both remain temporally compatible.
A rollback occurs and recovery follows, yet the storage system was also restarted. The timeline cannot attribute recovery to rollback alone. The analyst creates collection tasks for deployment diffs, storage telemetry and controlled replay. The assessment states what the sequence rules out, what it supports and what remains unresolved.
| Candidate explanation | Required temporal pattern | Observed constraint | Current assessment |
|---|---|---|---|
| Bad deployment | Change precedes errors; rollback precedes recovery | Deployment precedes errors; rollback overlaps storage restart | Still possible, recovery cause unresolved |
| Traffic surge | Load rise precedes degradation | Verified rise begins after errors | Weakened for onset |
| Storage fault | Latency rise precedes or overlaps errors | Intervals overlap | Still possible |
Changed-context transfer check
Change the case to a food-delivery delay using warehouse scans, vehicle location and customer messages. Rebuild the source and clock assumptions rather than copying the technical labels.
Limit and misconception
The outage is fictional. Real incident handling may involve privacy, security and legal duties, and the timeline should not publish sensitive system details beyond authorized recipients.
Evidence practice
Keep a versioned event table, clock register, hypothesis constraints and collection plan. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: attributing recovery to the most visible intervention when two interventions overlap. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
When time precision is incomplete, more than one sequence may fit the records. Writing only the preferred chronology hides sensitivity to uncertain order. A stronger method constructs plausible sequence variants and identifies which observations discriminate among them.
List hard constraints, soft constraints and unsupported assumptions. Generate a small set of materially different sequences rather than every mathematical permutation. For each, check actor capability, travel or processing time, known dependencies and expected traces. Mark decisive observations and collection opportunities. Retain rejected sequences with the reason they failed.
In the outage case, Sequence A has deployment causing application errors that overload storage. Sequence B has storage degradation causing errors, while deployment is coincidental. Both fit broad intervals. A deployment replay that reproduces the latency signature would discriminate more than another retelling of the incident.
Changed-context transfer check
Apply sequence comparison to a policy announcement and market reaction. Separate publication, private briefing, observation and reporting times.
Limit and misconception
Generating alternatives is not evidence that every story is equally plausible. Weight them by source quality, constraints and diagnostic evidence without forcing certainty.
Evidence practice
Keep a constraint matrix for each sequence and discriminating evidence list. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: presenting one coherent story as though coherence itself established truth. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 8 OF 12 · Test inference
8. Keep temporal precedence separate from causal explanation
A cause must precede its effect under the proposed mechanism, so chronology can falsify explanations with impossible order. Precedence alone is not sufficient. Common causes, background trends, selection, measurement delay and simultaneous interventions can create a persuasive sequence without the claimed causal link.
For each causal arrow, state the mechanism, expected delay, necessary conditions, alternative causes and observable implications. Ask whether the proposed cause changed while relevant alternatives remained stable. Look for intervention, counterfactual, comparative or process-tracing evidence appropriate to the domain. Phrase conclusions at the strength the evidence supports.
A training session occurs before error rates fall. The timeline supports the possibility that training contributed, but a software update and easier workload began in the same week. Without further evidence, “after training” should not become “because of training”.
Changed-context transfer check
Transfer the test to a maintenance action followed by improved equipment performance. Identify one mechanism check and one plausible common cause.
Limit and misconception
This guide teaches analytic discipline, not a universal causal-identification method. Different fields require designs and assumptions suited to their evidence.
Evidence practice
Keep a mechanism table with timing, alternatives and expected observations. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: converting before-and-after order into a causal verdict. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 9 OF 12 · Test inference
9. Map source dependence and circular reporting on the timeline
Repeated entries can appear to corroborate an event when they descend from one source. A later report may copy an earlier message, while a summary cites both. Timeline analysis should connect reports to their source routes so quantity is not mistaken for independence.
Create a source genealogy: who observed, who recorded, who transmitted and which later products reused the claim. Link each timeline entry to that genealogy. Compare independent access, incentives and collection conditions. Preserve disagreements rather than averaging timestamps that reflect different underlying propositions.
Three staff messages say a deployment ended at 10:15, but all quote one operations post. A system audit log independently shows 10:18. The evidence consists of one communicated claim and one machine record, not four votes. The three-minute difference requires interpretation of what “ended” means in each source.
Changed-context transfer check
Apply the genealogy to news reporting or a multi-team incident channel. Identify which nodes add observation and which only relay.
Limit and misconception
Independence is rarely binary. Sources can share data, methods or institutional incentives. Describe the relevant dependence rather than assigning a simplistic label.
Evidence practice
Keep a report-to-source graph joined to every timeline entry. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: counting repeated copies or common-source reports as independent confirmation. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 10 OF 12 · Test inference
10. Update the timeline without erasing prior assessments
New evidence can move an event, split one event into several or reveal that two labels described the same occurrence. A living timeline needs version control so readers can see what changed and whether the analytic judgement changed with it. Quietly rewriting the past prevents learning and can create false confidence.
Assign stable event identifiers, preserve source records and keep a change log for time, description, confidence and relationship updates. Record the assessment version and information cutoff. When a correction affects a conclusion, state the old and new judgement and the evidence responsible. Notify downstream users proportionately to the decision impact.
A recovered log moves storage degradation eight minutes earlier, making it precede the deployment. The analyst updates the event interval, revises hypothesis weights and flags a previous briefing that attributed onset mainly to configuration. The correction is visible rather than disguised as the original view.
Changed-context transfer check
Transfer the practice to a school safeguarding chronology or historical research database with appropriate access controls.
Limit and misconception
Versioning does not require publishing sensitive evidence widely. It requires authorized users to distinguish states and understand correction.
Evidence practice
Keep stable event IDs, source preservation, cutoff time and assessment change log. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: moving events on the chart without recording why or revisiting affected conclusions. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 11 OF 12 · Transfer and audit
11. Transfer the method to warning and after-action review
Timelines support both backward reconstruction and forward warning. In an after-action review, they reveal decision windows, delays and missing handovers. In warning, they help define sequences of indicators, expected lead times and escalation points. The same discipline applies: distinguish event from report and expected absence from missing collection.
Mark when information became available to each decision-maker, not only when events occurred. Compare the earliest actionable signal with actual recognition and response. For warning, define temporal patterns in advance and test them against historical cases and false alarms. Keep thresholds and response ownership outside the chart but linked to it.
A hazard sensor crossed a threshold at 08:10, the control room received an alert at 08:12, staff acknowledged it at 08:19 and protective action began at 08:35. The timeline shows technical latency, human recognition time and decision delay separately, enabling different repairs.
Changed-context transfer check
Apply the decision-availability timeline to a student-support referral or supply-chain disruption. Avoid using hindsight information that the original actor could not know.
Limit and misconception
After-action analysis should support learning and accountability without assuming every delay was avoidable. Capacity, authority and competing risks need evidence.
Evidence practice
Keep event, availability, recognition, decision and action times with owners. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: judging a past decision with evidence that arrived only later. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 12 OF 12 · Transfer and audit
12. Audit the reconstruction from source fragment to explanation
The final audit asks whether the timeline preserves evidence identity, clock assumptions, uncertainty, source dependence, gaps, alternative sequences and the boundary between chronology and causality. A visually impressive chart fails if a reader cannot trace a decisive placement back to its record and understand how precise it really is.
Sample pivotal entries and reproduce their normalized times from the original sources. Re-run clock alignment, gap classification and sequence constraints. Ask an independent reviewer to construct a competing explanation from the same record. Check that rejected explanations have explicit reasons and that unresolved questions became collection tasks or decision limits.
An audit finds that a key event uses the time of a later spreadsheet import. Replacing it with the source interval reopens two sequences previously marked impossible. The report updates its assessment and strengthens the data model so import time cannot masquerade as event time again.
Changed-context transfer check
Apply the audit to a short five-event classroom case and a long institutional investigation. Scale tooling and access while preserving the same evidence chain.
Limit and misconception
A timeline can discipline reasoning without guaranteeing a single true narrative. Some uncertainty remains irreducible when records were never created or preserved.
Evidence practice
Keep a source-to-event audit with clock, gap, dependency and hypothesis checks. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: accepting narrative coherence or graphical polish as a substitute for traceable temporal evidence. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Connected articles
Advanced boundary cases
Adversarial timestamp manipulation
When actors may alter logs or clocks, treat timestamp integrity as a claim requiring independent anchors, protected logging and provenance. Precision cannot rescue a compromised source.
Bitemporal records
Some systems preserve both when a fact was valid in the world and when the database learned it. Keep valid time and transaction time separate when reconstructing decisions.
Multiple locations and travel constraints
Use explicit travel or processing intervals to rule out impossible sequences, while preserving uncertainty in identity, route and clock alignment.
Sensitive chronologies
Timelines can reveal behaviour, relationships and vulnerability. Apply purpose limitation, access control, minimisation and review before distributing them.
A practical field check
Choose one incident, decision or fictional case with at least four sources. Define the temporal question before arranging any entries.
- Separate events, observations, records and reports.
- Preserve original times and normalize clocks with stated uncertainty.
- Represent intervals and partial orders honestly.
- Classify gaps by collection capability and expected trace.
- Construct at least two materially different sequences.
- Test causal arrows with mechanisms and alternatives.
- Version the timeline and record assessment changes.
Run the check as a small workbook
Run four passes. First reconstruct a clean case with synchronized clocks. Second add one copied report and show why it is not independent corroboration. Third replace one exact time with a broad interval and identify which orders reopen. Fourth add new evidence after the cutoff and produce a transparent revision. Keep both timeline states so the reasoning change remains inspectable.
| Audit question | Evidence | Stop condition |
|---|---|---|
| What does each time mean? | Event, observation, record and report fields | One timestamp column carries every meaning |
| How certain is the order? | Intervals, clock register and partial-order constraints | Every item is forced into exact order |
| Which gaps matter? | Collection capability and expected-trace analysis | Silence is treated as automatic absence |
| Which explanation survives? | Alternative sequences, mechanisms and diagnostic evidence | The preferred story is the only model retained |
Chapter-by-chapter evidence audit
| Chapter | Evidence to keep | Failure to catch |
|---|---|---|
| 1. Start with a temporal intelligence question | The focal outcome, time boundary, event definition and analytic cutoff | Collecting every dated item before deciding which temporal uncertainty matters |
| 2. Separate events, observations, records and later reports | A source-linked event table preserving original and normalised times | Using document creation time as the event time or counting repeated reports as separate events |
| 3. Reconcile time zones, clock drift and asynchronous systems | A clock register, conversion formula, uncertainty range and anchor-event test | Sorting raw timestamp strings and treating the resulting order as ground truth |
| 4. Represent intervals and granularity instead of false exactness | Time intervals, partial-order constraints and precision provenance | Replacing uncertain intervals with exact points to make the chart sortable |
| 5. Treat gaps as questions, not automatic evidence of absence | A gap register with collection capability, expected trace and alternative causes | Treating every unrecorded event as proof that the event did not occur |
| 6. Worked example: reconstruct a fictional service outage | A versioned event table, clock register, hypothesis constraints and collection plan | Attributing recovery to the most visible intervention when two interventions overlap |
| 7. Compare competing sequences explicitly | A constraint matrix for each sequence and discriminating evidence list | Presenting one coherent story as though coherence itself established truth |
| 8. Keep temporal precedence separate from causal explanation | A mechanism table with timing, alternatives and expected observations | Converting before-and-after order into a causal verdict |
| 9. Map source dependence and circular reporting on the timeline | A report-to-source graph joined to every timeline entry | Counting repeated copies or common-source reports as independent confirmation |
| 10. Update the timeline without erasing prior assessments | Stable event IDs, source preservation, cutoff time and assessment change log | Moving events on the chart without recording why or revisiting affected conclusions |
| 11. Transfer the method to warning and after-action review | Event, availability, recognition, decision and action times with owners | Judging a past decision with evidence that arrived only later |
| 12. Audit the reconstruction from source fragment to explanation | A source-to-event audit with clock, gap, dependency and hypothesis checks | Accepting narrative coherence or graphical polish as a substitute for traceable temporal evidence |
Connected articles across the eduKate ecosystem
Start with the governing route
- The Gold Standard of Intelligence
- The Gold Standard of Education | Learning That Transfers into Life
- How X Works hub
Continue into verified specialist studies
- Source triangulation, circular reporting and corroboration networks — maps how reports inherit or independently obtain evidence.
- Competing hypotheses, diagnosticity and evidence matrices — tests explanations against discriminating evidence rather than narrative fit.
- Collection requirements, source validation and analytic gaps — turns unresolved temporal questions into focused collection.
- Key Assumptions Check, evidential support, confidence and assumption reversal — tests clock, identity and mechanism premises supporting the sequence.
- Indicator validation, base rates and warning thresholds — extends the timeline into prospective warning sequences and response rules.
- Words of estimative probability, numeric ranges and confidence — helps communicate unresolved order and bounded conclusions consistently.
Questions readers often ask
Is a timeline just a list of dates?
No. A useful analytic timeline preserves evidence type, source, clock meaning, precision, uncertainty, dependencies and the question the sequence is meant to answer.
Which timestamp should be used?
Keep the original timestamps and distinguish event, observation, record and report time. Normalize them only with documented clock and conversion rules.
Does an earlier event cause a later one?
Not by sequence alone. Precedence can rule out impossible causes, but mechanism and evidence against alternatives are also needed.
What does a gap in the timeline mean?
It may mean absence, lack of observation, collection outage, record loss or a process that leaves no trace. Test collection capability before interpreting it.
Why keep rejected sequences?
They show which constraints mattered and make later revision possible if a decisive record or clock assumption changes.
Can timelines support warning?
Yes. Historical sequences can help define indicator order and lead time, but warning patterns need prospective validation, thresholds and response ownership.
Sources and scope
CIA Center for the Study of Intelligence: A Tradecraft Primer — official primer on structured analytic techniques, including chronologies, timelines, hypothesis testing and diagnostic evidence.
CIA Center for the Study of Intelligence: Tradecraft Primer publication page — official context and access route for the primer.
Office of the Director of National Intelligence: ICD 203 Analytic Standards — official analytic standards for sourcing, uncertainty, alternatives, relevance and clear argumentation.
CIA Center for the Study of Intelligence: Psychology of Intelligence Analysis — official text on mental models, evidence, alternative hypotheses and limits of intuitive judgement.
All incidents, logs, messages and assessments in the worked examples are fictional. This guide teaches evidence discipline for lawful analysis; it does not authorize surveillance, access to restricted records or operational action.
“Gold standard” describes the educational benchmark explained in this guide. It is not an official accreditation, legal opinion, policy determination or professional certification.
Back to contents · Return to the Intelligence root · Return to the Gold Standard of Education