Use a table with columns for track, item, creator or custodian, displayed time, time zone, confidence, gap, and next step. Track one is flight identity: airline, flight number, date, origin, destination, departure gate, arrival gate, aircraft registration or type if reliably known, diversion, and actual arrival. Copy rather than reinterpret the source. A schedule is not proof of actual movement time.
Track two is the cabin sequence: seat and aisle location, overhead-bin or service-cart position, seat-belt sign as actually observed, announcements, crew response, witness viewpoints, and any movement before or after the event. The federal passenger-information rule at 14 CFR 121.317 provides context for seat-belt signs and passenger instructions. It does not establish what occurred on a particular flight or who was responsible.
Track three is weather or turbulence: observed conditions, announcements, any pilot report found, official weather products, and the time and location each source covers. Track four is medical response: onboard assistance, request for medical support, diversion if any, gate or ramp response, EMS contact, and later diagnosis. Track five is federal and complaint material: any NTSB investigation page or docket, relevant FAA material, and a DOT complaint confirmation if one was filed.
Never merge the five tracks into a single polished timeline until clocks and source limits are visible. Keep local airport times, UTC aviation times, device times, and estimated witness times labeled. The goal is traceability. A four-minute difference between a camera and a dispatch system may reflect an offset, an estimate, or a real sequence; the table should preserve all three possibilities.