'Retrieves the timeline items for a given folder.
The timeline consists of items indicating a state change of a file. To
construct the timeline, MAC times are used. Whenever a timestamp on a
file changes, a corresponding timeline item is created.
Args:
folder_urn: The urn of the target folder.
token: The user token.
Returns:
A list of timeline items, each consisting of a file path, a timestamp
and an action describing the nature of the file change.'

@staticmethod
def GetTimelineItems(folder_urn, token=None):

    child_urns = []
    for (_, children) in aff4.FACTORY.RecursiveMultiListChildren(folder_urn, token=token):
        child_urns.extend(children)
    attribute = aff4.Attribute.GetAttributeByName('stat')
    items = []
    for (subject, values) in data_store.DB.MultiResolvePrefix(child_urns, attribute.predicate, token=token):
        for (_, serialized, _) in values:
            stat = rdf_client.StatEntry.FromSerializedString(serialized)
            for c in 'mac':
                timestamp = getattr(stat, ('st_%stime' % c))
                if (timestamp is not None):
                    item = ApiVfsTimelineItem()
                    item.timestamp = (timestamp * 1000000)
                    item.file_path = '/'.join(str(subject).split('/')[2:])
                    if (c == 'm'):
                        item.action = ApiVfsTimelineItem.FileActionType.MODIFICATION
                    elif (c == 'a'):
                        item.action = ApiVfsTimelineItem.FileActionType.ACCESS
                    elif (c == 'c'):
                        item.action = ApiVfsTimelineItem.FileActionType.METADATA_CHANGED
                    items.append(item)
    return sorted(items, key=(lambda x: x.timestamp), reverse=True)
