Create 04-timeline-construction.md

Author: ngvuthdanhh

operations/04-timeline-construction.md

@@ -0,0 +1,24 @@
+# 04 — Timeline Construction
+
+## MACB Timeline Model
+- Modified
+- Accessed
+- Changed
+- Born (Created)
+
+## Normalization Rules
+- Convert timestamps to unified timezone.
+- Remove duplicates.
+- Reconcile conflicting timestamps.
+
+## Anomaly Detection
+- Gaps or bursts of activity.
+- Suspicious timestamp clusters.
+- Future-dated or backdated events.
+
+## “Divide & Conquer” Timeline Method
+1. Break timeline into segments.
+2. Identify pivot events.
+3. Trace backward to find cause.
+4. Trace forward to determine impact.
+5. Remove irrelevant periods.