Temporal / Timing Correlation Analysis
tactic
Core idea
Correlates transaction timestamps with external events such as login times or exchange session logs to strengthen attribution. Typically combined with subpoenaed off-chain data.
When to use
On-chain evidence alone is inconclusive and corroborating off-chain timestamps are available.
Avoid when
Requires proper chain-of-custody for off-chain logs; document time-zone and UTC handling carefully or the correlation will not hold up in court.
Example
Matching the UTC timestamps of suspect withdrawals to the exchange login/IP session logs obtained by subpoena.
Related
Last updated on