Security incident timeline reconstruction calculator

Calculate event IDs ordered by central UTC timestamp and definitely ordered event pairs with your own figures.

Your numbers

Use the units shown. Results update as you change valid inputs.

Use event IDs ordered by central UTC timestamp and definitely ordered event pairs to compare changes to your inputs. The method and limits below explain the scope.

Examples

Examples

Try the starting example

Events: ID, local YYYY-MM-DDTHH:MM, UTC offset minutes east positive, symmetric timestamp uncertainty minutes
A,2026-10-20T10:00,60,1 B,2026-10-20T10:05,60,2 C,2026-10-20T09:02,0,2
Event IDs ordered by central UTC timestamp
A, C, B
Definitely ordered event pairs
A<B
Pairs with overlapping/touching uncertainty intervals
A/C, B/C
Earliest possible UTC time by event
A: 2026-10-20T08:59; B: 2026-10-20T09:03; C: 2026-10-20T09:00
Latest possible UTC time by event
A: 2026-10-20T09:01; B: 2026-10-20T09:07; C: 2026-10-20T09:04

Try another scenario

Events: ID, local YYYY-MM-DDTHH:MM, UTC offset minutes east positive, symmetric timestamp uncertainty minutes
A,2026-10-20T10:00,60,1 B,2026-10-20T10:05,60,2 C,2026-10-20T09:02,0,0
Event IDs ordered by central UTC timestamp
A, C, B
Definitely ordered event pairs
A<B, A<C, C<B
Pairs with overlapping/touching uncertainty intervals
None
Earliest possible UTC time by event
A: 2026-10-20T08:59; B: 2026-10-20T09:03; C: 2026-10-20T09:02
Latest possible UTC time by event
A: 2026-10-20T09:01; B: 2026-10-20T09:07; C: 2026-10-20T09:02
Calculation method

Calculation method

Event IDs ordered by central UTC timestamp

Central UTC=local fixed-offset time−declared offset; ties retain input order.

Definitely ordered event pairs

A is definitely before B only when latest(A)<earliest(B).

Pairs with overlapping/touching uncertainty intervals

Intervals overlap or touch, so strict order is not proven.

Earliest possible UTC time by event

Central UTC−supplied symmetric uncertainty.

Latest possible UTC time by event

Central UTC+supplied symmetric uncertainty.

Symbols and units
a
Events: ID, local YYYY-MM-DDTHH:MM, UTC offset minutes east positive, symmetric timestamp uncertainty minutes

Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.

Assumptions & limits

Assumptions & limits

  • A supplied timestamp-uncertainty chronology. Central-time sorting does not establish causality; overlapping intervals remain unordered. No timezone database, DST inference, clock synchronization or forensic record collection is performed.
Are these inputs private?

These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.

Further reading

NIST SP 800-53: background for inventory, access, audit and contingency controls; worksheet algorithms and rules are explicitly supplied, not NIST compliance tests ↗

Background reading; this does not imply endorsement or independent review of SumFizz.

Share this page
Share this calculator

Leave unchecked to share the page without your entered values.