A forensic timeline is the time-ordered record investigators look for when they search “forensic timeline”: who said what, when it arrived, and what changed afterward. In scam work, that includes messages later removed from the visible chat. For trust-and-safety and fraud investigators, the point is to preserve sequence before cleanup hides payment instructions, contact points, or files.
Active Defense runs AI decoy personas on Telegram and by e-mail, stores each inbound message the moment it arrives, and turns what scammers send into a threat-intelligence feed. Replies are drafted by AI and approved by a human operator by default.
What a forensic timeline is supposed to show
A useful forensic timeline for scam investigations should show more than a scroll of chat messages. At a minimum, it should capture first contact, each inbound message, attachments, any edits or deletions visible to the investigator, the indicators extracted from what was received, and links to related conversations.
The goal is not just chronology for its own sake. Investigators need the sequence that explains how the scam developed: which request came first, when payment instructions appeared, when a handle or account was introduced, and which artifacts arrived at each step. That order matters because payment requests, wallet addresses, bank details, and messenger accounts often appear briefly and may be removed after the scammer thinks the target has copied them.
A strong timeline preserves raw arrival events, not only a later snapshot of the chat after cleanup by the scammer. That is the practical difference between a user-facing chat view and an investigative record. The user sees the current state of the conversation. The investigator needs the historical state, including material that was present at receipt time but is no longer visible later.
It should also cover non-text artifacts such as photos, voice messages, and files. In many scam flows, key instructions move into media rather than staying in plain text. For a deeper look at deletion behavior and retention, see what investigators can still retain.
How deleted scam messages can still remain in the record
The preservation principle is simple: if a system stores a message when it arrives, a later delete action in the messenger does not erase the earlier stored copy. For investigators, that difference is the foundation of a usable forensic timeline. It means the record can show what was actually received at the time, rather than only the version of the chat left behind after a scammer tries to clean it up.
In Active Defense, every message a decoy receives is stored the moment it arrives, so a scammer’s later “delete for everyone” does not remove that copy. That gives the timeline a clear basis: receipt time and original content as seen by the decoy, not the tidied-up state the scammer wanted afterward.
This matters most in Telegram and e-mail, where scammers may retract or overwrite traces after passing along payment instructions, account handles, links, or other identifying details. A record built from arrival-time storage preserves those steps in sequence.
The same principle applies to media. Photos, voice messages, and files are preserved as part of the received record. Files, voice messages, and photos are kept by SHA-256, and photos also carry a perceptual hash so reused images can be recognized when they appear again in another chat.
That closes a common gap in chat investigations because important evidence often sits in media, not just text, such as:
- screenshots of payment steps
- fake receipts
- profile photos
- voice notes
- files sent to support a scam story
The purpose here is reconstruction of the conversation record. It is not about altering a scammer’s account or interacting beyond the decoy conversation itself.
What investigators should extract from the timeline
For a forensic timeline to be useful to trust-and-safety and fraud investigators, extraction has to produce structured artifacts, not just a readable record. The output should let a team review one conversation and then compare it with other cases without retyping details from deleted or short-lived messages.
The practical extraction set includes:
- crypto wallets for BTC, ETH, TRON, and SOL
- URLs
- e-mail addresses
- phone numbers
- messenger accounts
- bank details, including IBAN and SWIFT
- gift cards
- payment handles
- file hashes
- photo hashes
Each extracted item should be scored. In Active Defense, every indicator gets a confidence score based on a structural check and an LLM. That gives investigators a way to separate a likely wallet, handle, or bank detail from a string that only looks similar.
Some artifacts need extra context. Wallets are one example, because they often matter beyond a single chat. For more on that, see what crypto wallets can show fraud teams.
The timeline output should also be usable outside the case view. Active Defense turns what scammers hand over into a threat-intelligence feed, and each customer gets their own feed with STIX 2.1 export. If your team needs structured sharing or ingestion, see how STIX 2.1 fits scam indicator feeds.
For broader context beyond one timeline, see the weekly scam briefings from live conversations and the monthly scam data reports.
From one deleted chat to actor-level linkage
A forensic timeline becomes much more useful when it shows which deleted chat belongs with which other chats. For trust-and-safety and fraud investigators, the question is usually not whether one message was removed, but whether the removed material is part of a repeat operator, a recycled persona, or a wider scam flow.
The practical step is linkage. In Active Defense, chats that share an indicator, a reused photo, or a forwarded account are linked to one actor. That lets investigators treat a deletion as one event inside a larger pattern instead of as a closed, single-chat incident.
This matters when scammers rotate surface details but keep parts of the operation stable, such as:
- the same wallet or bank detail appearing in different chats
- one photo reused under different names
- a forwarded account showing up again after a chat is cleaned up
- repeated contact points across separate conversations
That kind of linkage helps answer operational questions fast:
- Is this a new report or the same actor resurfacing?
- Did only the story change, while payment or contact artifacts stayed the same?
- Which conversations should be reviewed together?
- Which indicators belong in downstream detection and sharing?
For teams building repeatable review workflows, correlation across indicators is what turns isolated artifacts into a case pattern. Linking accounts across chats then helps separate a one-off signal from an actor that keeps reappearing. Once those relationships are established, they can move into scam indicator feeds for broader operational use.
How Active Defense builds the timeline during live engagement
Active Defense builds the forensic timeline while the conversation is still active. For investigators searching for a forensic timeline, that matters because the record is created from live scammer contact on Telegram and by e-mail, not assembled later from a partial case summary.
The process starts at first contact. A classifier checks each new chat as it arrives. On messengers, when the system is unsure, it leaves the chat alone.
When a conversation moves forward, replies are drafted by AI and approved by a human operator before sending by default. Messages go out in short form and with typing pauses. That keeps the engagement controlled and gives investigators a clearer event sequence to review afterward.
As the chat develops, the timeline can accumulate:
- inbound messages in order
- media and files tied to the conversation
- scored indicators from what the scammer sends
- links to other chats connected to the same actor
The console and API run on Azure in Germany.
Using the timeline in practice
For investigators, the timeline is a working record, not just stored evidence. It helps teams review what happened in order, pull scored indicators into internal tooling, and decide which chats belong to the same actor before action is taken elsewhere.
It also supports sharing. Each customer gets their own feed with STIX 2.1 export, and that feed can be rebuilt from stored history if a team needs the record again.
To assess the output, qualified leads can request a free feed sample. There is also a 90-day pilot for up to 500 conversations at 1,900 EUR net, credited to the subscription afterward.
Questions investigators ask about a forensic timeline
What makes a forensic timeline usable in an investigation, not just readable?
A usable forensic timeline lets an investigator move from review to action without rebuilding the case by hand. It should keep each event in order, preserve the original record, and let teams export what they need for downstream systems.
For trust-and-safety and fraud teams, the practical test is whether the timeline supports:
- case review
- indicator triage
- actor clustering
- feed export
That matters when one conversation needs to become part of a larger investigation instead of staying as an isolated transcript.
What should a timeline show about confidence, not just content?
Content alone is not enough. Investigators need to know how strongly the system believes a wallet, phone number, bank detail, or handle is actually present. A useful forensic timeline should therefore show scored indicators, not only extracted strings.
In Active Defense, each indicator carries a confidence score from a structural check and an LLM. That helps teams sort likely signal from noise and decide what to review first.
Can a forensic timeline support structured sharing across teams?
Yes. A forensic timeline is more useful when it can be turned into a customer’s own threat-intelligence feed without losing the record behind it.
Active Defense gives each customer their own feed with STIX 2.1 export. Because the record is stored as messages arrive, the feed can be rebuilt from stored history when teams need to reproduce what was captured.
A forensic timeline is only useful if it survives cleanup
Forensic timeline work breaks down when the record reflects only what remains visible at the end. Investigators need a timeline that keeps the original sequence intact after deletions.
That means one record can hold:
- the message as received
- attached media and file hashes
- scored indicators
- links between chats tied to one actor
In Active Defense, inbound messages are stored the moment they arrive, so later cleanup does not remove the preserved copy.