Timeline Analysis Tools for Fire Investigation

Timelines are an important tool for developing, testing and/or eliminating hypotheses within a fire investigation.  Timelines provide critical data for origin and cause determination, and one piece of timeline data can make or break these determinations.  Consider, for example, how many times investigators must rule in or eliminate smoking/careless discard of smoking materials as a cause hypothesis.  It is critical that fire investigators have access to a timeline analysis tool to help with their fire investigation.

After origin and cause hypothesis testing, investigators may use timelines to support an origin and/or cause conclusion.  They may even have to present this conclusion in court, using the timeline to support their testimony.  The value of timeline analysis cannot be overstated, and when the data is available investigators should be engaged in analyzing this data.  A timeline analysis should be undertaken in every fire investigation.

Timeline Analysis Tools for Fire Investigation Must Address Certain Critical Elements

Timelines can take on many shapes and sizes – as well as varying in length and complication.  A properly developed timeline will strengthen the investigator’s conclusions.  A poorly developed or analyzed timeline will lead to mistaken conclusions and increased scrutiny of the investigator’s expertise.  All well-built timelines share four critical elements. Timeline data must be:

1. Complete – collected and preserved in its entirety as soon as possible, with source details and time/date stamps

2. Synchronized – to compare events from different sources, the individual source data must be synchronized to a common clock (also known as a master clock)

3. Relevant – the data must be such that it can be analyzed and compared with other scene information

4. Presentable – the data must presented in a clear and concise manner

Critical Element 1 – Complete Data Collection

Timelines might include data collected from security camera footage, cellular telephone data, alarm system data, computer data, vehicle data, witnesses, witness photographs, etc. At times there may be unique sources of data such as WiFi antennas, router information, and home automation (“smart home” or IoT) systems. 

The collection of this data is time sensitive and should be an investigative priority.  Simply going out (e.g. doing a neighborhood canvas), identifying sources of data and preserving this data is critical, as some data is overwritten relatively quickly, and the data analysis can occur at a less frenzied pace once the data has been secured.  Investigators should be armed with phones, cameras, and/or thumb drives when conducting neighborhood canvasses for witnesses.  If they stumble across important electronic data (e.g. video) they can obtain it right away.  When obtaining data relevant to the timeline, investigators must undertake the following steps to ensure its complete collection:

1. Document source of the data (make, model, owner)

2. Document the source’s timestamp and compare it to a common clock (see “Synchronization” below)

3. Obtain enough data before, during, and after the incident to be able to look for items of interest prior to or after the fire

4. If saving electronic data, utilize a file naming system that makes sense

5. Use a working copy for analysis, while preserving the original as evidence and maintaining a properly documented chain of custody

Investigators must correctly source the data not only within the timeline, but within their investigative reports.  When sourcing the data, investigators should refer to what report it is contained in, what evidence item number it may represent, who obtained it, and when they obtained it.  

Hard and Soft Times

In timeline analysis, investigators use one or more sources of information to determine the sequence of events which are of investigative interest. However, not all timeline data can be treated equally. While appliances like cameras and cell phones give timestamps for events that can be traced back to a common clock, witnesses usually provide an estimated times of events. When using a timeline, the investigator must distinguish between these “hard” and “soft” times.  

NFPA 921 (2024 ed.), Guide for Fire and Explosion Investigation, Section 21.2.2.1 states that a hard time identifies a specific point in time that is directly or indirectly linked to a reliable clock or timing device of known accuracy.  The document warns in Section 21.2.2.2 that, “All clocks and timing devices are usually not synchronized.  Discrepancies between different clocks should be recorded and adjustments made where necessary.”  Hard time sources include (but are not limited to): fire/police department dispatch logs; security and fire protection system records (on site, central station, etc.); surveillance and security video; employee accountability records; cell phones; retail transactions; smart meter data; smart thermostats, etc.

NFPA 921 Section 21.2.3.1 defines a soft time as, “either estimated or relative time.  Relative time is the chronological order of events or activities that can be identified in relation to other events or activities.  Estimated time is an approximation based on information or calculations that may or may not be relative to other events or activities.”  Investigators should attempt to narrow soft time estimations by witnesses by bracketing them with significant events.  

Critical Element 2 -Synchronization

In fire investigations, which often use multiple sources of time-based data, clock discrepancies are likely to be found. Given that today’s typical bedroom fire can progress to flashover in 3-5 minutes, a timeline discrepancy of several minutes may have a significant impact on the investigation.  In event timeline analysis, it absolutely critical to ensure the event times from multiple sources are synchronized to a common clock. Without synchronization, the analysis will be flawed and perhaps even useless.

What’s a common clock?

The foundation of timeline synchronization is a common clock (also known as a master clock) to which all events can be referenced. In theory, this could be any clock (a cell phone, an investigator’s computer, etc.), provided it is consistent and available throughout the investigation. However, it is recommended that investigators use the U.S. Official Time, which is provided by the National Institutes for Technology (NIST) and the U.S. Naval Observatory, and is available at www.time.gov. With smart phones, this is easy to do on scene if you have internet access. 

Although cell phones and other networked devices typically have clocks which are automatically set to the official U.S. time (by a cellular network, GPS clocks, etc.), these clocks can usually be manually changed by the user. Therefore, you should only rely on them if you know they are automatically set. 

Most data can by synchronized with other events which are based on identified hard times.  For video data, synchronization can be done by recording the time stamp on the video when collecting it while simultaneously noting the time at time.gov (or your phone, if internet access is not available).  This will give you a documented time offset. The synchronized time for an event is then calculated by adding or subtracting the time offset (if time.gov is ahead of the source clock, add the offset; if is behind, subtract it):

Synchronized event time = Source time +/- Difference between source and time.gov time

Investigators can also use an event which generated a hard time, like the arrival of fire apparatus, to develop time synchronization on the video.  This is especially helpful if the same event, like the apparatus response, is documented in several sources.  Then all of these sources can be synchronized based on this one event, especially if it generated a hard time. 

Critical Element 3 – Relevant Data and Organizing Your Timelines

It is recommended that at the beginning of any fire investigation, investigators create a spreadsheet or some other document which can easily track synchronization. A few years ago, the U.S. Department of Justice’s Bureau of Alcohol Tobacco, Firearms and Explosives (ATF) developed a timeline spreadsheet (Excel-based) that tracks individual sources of information such as phone data, videos, dispatch logs, etc.  Users input events from each source into individual spreadsheets, which is automatically incorporated into a master timeline.  The documented event information includes details about the source, event time(s) and date(s), and cross reference the entry to a report and/or evidence item number. 

With user input, the spreadsheet automatically does the math and calculates the actual time so that the master timeline is synchronized.  The spreadsheet will also allow for the inclusion of soft times as well. The spreadsheet has an export function which will then generate a text listing of events for inclusion into a report or another spreadsheet.  

TimeScene is an advanced tool that builds upon this basic spreadsheet.  Its platform transforms raw investigative data into precise, synchronized timelines. Leveraging AI-driven data extraction, TimeScene automatically interprets, filters, and organizes complex inputs – such as 911 dispatch logs, video metadata, smart device logs, and witness statements – into chronological timelines anchored to the official U.S. Government time standard.  Timelines can then be derived from a single source, multiple sources, or select sources.  These timelines can then be exported in a variety of formats such as Word or Excel for incorporation into larger investigative files.

As with data from the fire scene, the analysis of timeline data must be placed within context of the larger fire investigation.  Most of the timeline data cannot stand alone – in and of itself it may mean very little.  If a piece of the timeline is inconsistent with other data generated in the case, the investigator is obligated to resolve this inconsistency.  Using a timeline means the investigator will be responsible for describing it to interested parties, and maybe even testifying to it.  The investigator will have to describe why it is relevant to the origin and/or cause of the fire, and discuss what conclusions can or cannot be drawn from the timeline.  

Critical Element 4 – Presentable Timeline Products

Timelines may have to be presented in reports and ultimately in court.  The investigator must ensure that if they use a timeline analysis to any conclusions, the data and analysis should be synopsized in their report.  

Investigators should be prepared to testify to their timeline analysis.  Investigators should be able to describe how, when, and from whom they obtained the data, what they did to synchronize and analyze it, and why it is relevant.  It is recommended that, when possible, all of these items be described in the origin and cause report or subsequent investigative reports.  This will serve to help the investigator’s memory when they are called to testify months or years after the fact, allow for scrutiny by the attorneys involved in the case, and strengthen the investigator’s credentials.  Particularly in the case of testifying to video evidence used in a timeline, the investigator should understand the common issues of re-playing video.  Many of the security systems use proprietary players.  When using something other than a proprietary player, the critical time stamp seen on the screen may disappear.  Investigators should note not only the video time stamp, but the cursor time stamp so that accurate play back in court is smooth and seamless. 

Conclusion

Timelines are an important tool in fire investigations.  All fire investigations should include and analysis of the timeline of events.  Well-built timelines are complete, synchronized, relevant, and presentable.  Timelines can provide critical data for origin and cause determination, or give context to other data recorded in an investigation.  A properly developed timeline will help build hypotheses, help test hypotheses, and ultimately strengthen the investigator’s conclusions, whereas a poorly developed or analyzed timeline will lead to erroneous conclusions. 

TimeScene empowers fire investigators with intuitive timeline-building tools, robust evidence management, and seamless collaboration features—streamlining every phase of building an investigative timeline. By leveraging TimeScene, you can capture every critical detail, visualize incident progression, and generate comprehensive reports with unprecedented efficiency and accuracy. Don’t let valuable insights slip through the cracks—start using TimeScene today and transform how you document, analyze, and resolve fire investigations. Your next investigative breakthrough could be just a timeline away.