may be constructed by using only the event data correspondence to storage reads for the storage medium of interest and finding the corresponding start and end times for each storage read likewise a storage write timeline may be constructed by using only the event data corresponding to storage writes for the storage media of interest and finding the corresponding start and end times for each storage write non storage timelines may also be constructed based on the time recorded for corresponding non storage events e g when a thread begins active execution and when a thread ends active execution the storage access timelines and potentially the non storage timelines are then displayed act 212 fig3 illustrates an example architecture 300 that may be instantiated in the memory of the computing system upon execution of the method 200 although some or all of the illustrated components may also be implemented in hardware or a combination or software and hardware to formulate a computer program product the architecture 300 includes an event generation module 310 configured to detect storage access events that occur during the execution of the target program and generate timeline details of each of at least some of the detected storage access events the events generation module 310 may also generate non storage events as mentioned above the etw framework is an example of the events generation module 310 a collections module 320 collects the timeline details of each of at.