Create an incident timeline with clear evidence
Prepared 22 October 2026 by NightMarshal

Build an incident timeline from observed events, system records and recorded actions, keeping each source and time zone visible. Separate what the footage shows from an interpretation or an unconfirmed report.

Instructions
1. Collect authorized evidence references.
2. Enter time, zone, observed fact and source for each event.
3. Review discrepancies and keep interpretations labeled.

Open the blank CSV in a spreadsheet app; add one row per item. Use Pending for unknowns and N/A only where a field truly does not apply. Review the separate example CSV; all example values are fictional. Keep completed sheets private. Do not include passwords, access codes, personal contacts, footage links or camera stream URLs. No input is collected by these downloads.

Fields
Time
Zone or offset
Observed fact
Source reference
Certainty
Open question

Fictional example
Fictional entry: “01:14Z: person visible inside gate, clip G01-TEST.” A separate row records an attempted call; acknowledgement is added only when confirmed.

Limits
This worksheet is not a forensic opinion or proof of identity. Follow your organization’s evidence handling procedure.