Timelines are an important tool for developing, testing and/or eliminating hypotheses within a fire investigation. Timelines provide critical data for origin and cause determination, and one piece of timeline data can make or break these determinations. Consider, for example, how many times investigators must rule in or eliminate smoking/careless discard of smoking materials as a cause hypothesis.
After origin and cause hypothesis testing, investigators may use timelines to support an origin and/or cause conclusion. They may even have to present this conclusion in court, using the timeline to support their testimony. The value of timeline analysis cannot be overstated, and when the data is available investigators should be engaged in analyzing this data. A timeline analysis should be undertaken in every fire investigation.
Critical Elements
Timelines can take on many shapes and sizes – as well as varying in length and complication. A properly developed timeline will strengthen the investigator’s conclusions. A poorly developed or analyzed timeline will lead to mistaken conclusions and increased scrutiny of the investigator’s expertise. All well-built timelines share four critical elements. Timeline data must be:
1. Complete - collected and preserved in its entirety as soon as possible, with source details and time/date stamps
2. Synchronized – to compare events from different sources, the individual source data must be synchronized to a common clock (also known as a master clock)
3. Relevant – the data must be such that it can be analyzed and compared with other scene information
4. Presentable – the data must presented in a clear and concise manner
Critical Element 1 - Complete Data Collection
Timelines might include data collected from security camera footage, cellular telephone data, alarm system data, computer data, vehicle data, witnesses, witness photographs, etc. At times there may be unique sources of data such as WiFi antennas, router information, and home automation (“smart home” or IoT) systems.
The collection of this data is time sensitive and should be an investigative priority. Simply going out (e.g. doing a neighborhood canvas), identifying sources of data and preserving this data is critical, as some data is overwritten relatively quickly, and the data analysis can occur at a less frenzied pace once the data has been secured. Investigators should be armed with phones, cameras, and/or thumb drives when conducting neighborhood canvasses for witnesses. If they stumble across important electronic data (e.g. video) they can obtain it right away. When obtaining data relevant to the timeline, investigators must undertake the following steps to ensure its complete collection:
1. Document source of the data (make, model, owner)
2. Document the source’s timestamp and compare it to a common clock (see “Synchronization” below)
3. Obtain enough data before, during, and after the incident to be able to look for items of interest prior to or after the fire
4. If saving electronic data, utilize a file naming system that makes sense
5. Use a working copy for analysis, while preserving the original as evidence and maintaining a properly documented chain of custody
Investigators must correctly source the data not only within the timeline, but within their investigative reports. When sourcing the data, investigators should refer to what report it is contained in, what evidence item number it may represent, who obtained it, and when they obtained it.
Hard and Soft Times
In timeline analysis, investigators use one or more sources of information to determine the sequence of events which are of investigative interest. However, not all timeline data can be treated equally. While appliances like cameras and cell phones give timestamps for events that can be traced back to a common clock, witnesses usually provide an estimated times of events. When using a timeline, the investigator must distinguish between these “hard” and “soft” times.
NFPA 921 (2024 ed.), Guide for Fire and Explosion Investigation, Section 21.2.2.1 states that a hard time identifies a specific point in time that is directly or indirectly linked to a reliable clock or timing device of known accuracy. The document warns in Section 21.2.2.2 that, “All clocks and timing devices are usually not synchronized. Discrepancies between different clocks should be recorded and adjustments made where necessary.” Hard time sources include (but are not limited to): fire/police department dispatch logs; security and fire protection system records (on site, central station, etc.); surveillance and security video; employee accountability records; cell phones; retail transactions; smart meter data; smart thermostats, etc.
NFPA 921 Section 21.2.3.1 defines a soft time as, “either estimated or relative time. Relative time is the chronological order of events or activities that can be identified in relation to other events or activities. Estimated time is an approximation based on information or calculations that may or may not be relative to other events or activities.” Investigators should attempt to narrow soft time estimations by witnesses by bracketing them with significant events.
Critical Element 2 -Synchronization
In fire investigations, which often use multiple sources of time-based data, clock discrepancies are likely to be found. Given that today’s typical bedroom fire can progress to flashover in 3-5 minutes, a timeline discrepancy of several minutes may have a significant impact on the investigation. In event timeline analysis, it absolutely critical to ensure the event times from multiple sources are synchronized to a common clock. Without synchronization, the analysis will be flawed and perhaps even useless.
What’s a common clock?
The foundation of timeline synchronization is a common clock (also known as a master clock) to which all events can be referenced. In theory, this could be any clock (a cell phone, an investigator’s computer, etc.), provided it is consistent and available throughout the investigation. However, it is recommended that investigators use the U.S. Official Time, which is provided by the National Institutes for Technology (NIST) and the U.S. Naval Observatory, and is available at www.time.gov. With smart phones, this is easy to do on scene if you have internet access.
Although cell phones and other networked devices typically have clocks which are automatically set to the official U.S. time (by a cellular network, GPS clocks, etc.), these clocks can usually be manually changed by the user. Therefore, you should only rely on them if you know they are automatically set.
Most data can by synchronized with other events which are based on identified hard times. For video data, synchronization can be done by recording the time stamp on the video when collecting it while simultaneously noting the time at time.gov (or your phone, if internet access is not available). This will give you a documented time offset. The synchronized time for an event is then calculated by adding or subtracting the time offset (if time.gov is ahead of the source clock, add the offset; if is behind, subtract it):
Synchronized event time = Source time +/- Difference between source and time.gov time
Investigators can also use an event which generated a hard time, like the arrival of fire apparatus, to develop time synchronization on the video. This is especially helpful if the same event, like the apparatus response, is documented in several sources. Then all of these sources can be synchronized based on this one event, especially if it generated a hard time.
Critical Element 3 - Relevant Data and Organizing Your Timelines
It is recommended that at the beginning of any fire investigation, investigators create a spreadsheet or some other document which can easily track synchronization. The U.S. Department of Justice’s Bureau of Alcohol Tobacco, Firearms and Explosives (ATF) developed a timeline spreadsheet (Excel-based) that tracks individual sources of information such as phone data, videos, dispatch logs, etc. Users input events from each source into individual spreadsheets, which is automatically incorporated into a master timeline. The documented event information includes details about the source, event time(s) and date(s), and cross reference the entry to a report and/or evidence item number.
With user input, the spreadsheet automatically does the math and calculates the actual time so that the master timeline is synchronized. The spreadsheet will also allow for the inclusion of soft times as well. The spreadsheet has an export function which will then generate a text listing of events for inclusion into a report or another spreadsheet.
As with data from the fire scene, the analysis of timeline data must be placed within context of the larger fire investigation. Most of the timeline data cannot stand alone – in and of itself it may mean very little. If a piece of the timeline is inconsistent with other data generated in the case, the investigator is obligated to resolve this inconsistency. Using a timeline means the investigator will be responsible for describing it to interested parties, and maybe even testifying to it. The investigator will have to describe why it is relevant to the origin and/or cause of the fire, and discuss what conclusions can or cannot be drawn from the timeline.
Critical Element 4 - Presentable Timeline Products
Timelines may have to be presented in reports and ultimately in court. The investigator must ensure that if they use a timeline analysis to any conclusions, the data and analysis should be synopsized in their report.
Investigators should be prepared to testify to their timeline analysis. Investigators should be able to describe how, when, and from whom they obtained the data, what they did to synchronize and analyze it, and why it is relevant. It is recommended that, when possible, all of these items be described in the origin and cause report or subsequent investigative reports. This will serve to help the investigator’s memory when they are called to testify months or years after the fact, allow for scrutiny by the attorneys involved in the case, and strengthen the investigator’s credentials. Particularly in the case of testifying to video evidence used in a timeline, the investigator should understand the common issues of re-playing video. Many of the security systems use proprietary players. When using something other than a proprietary player, the critical time stamp seen on the screen may disappear. Investigators should note not only the video time stamp, but the cursor time stamp so that accurate play back in court is smooth and seamless.
Conclusion
Timelines are an important tool in fire investigations. All fire investigations should include and analysis of the timeline of events. Well-built timelines are complete, synchronized, relevant, and presentable. Timelines can provide critical data for origin and cause determination, or give context to other data recorded in an investigation. A properly developed timeline will help build hypotheses, help test hypotheses, and ultimately strengthen the investigator’s conclusions, whereas a poorly developed or analyzed timeline will lead to erroneous conclusions.
