Difference between revisions of "Timeline Analysis"

From ForensicsWiki
Jump to: navigation, search
(Timeline formats)
(Timeline formats)
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
 
== Timeline formats ==
 
== Timeline formats ==
 
* [[body file]]
 
* [[body file]]
 +
* [[L2T CSV]]
 
* [[mactime]]
 
* [[mactime]]
 
* [[TLN]]
 
* [[TLN]]
Line 50: Line 51:
 
; [[TimeFlow]] - Visual timelines for investigation - source freely available
 
; [[TimeFlow]] - Visual timelines for investigation - source freely available
 
https://github.com/FlowingMedia/TimeFlow/wiki/
 
https://github.com/FlowingMedia/TimeFlow/wiki/
 +
 +
; [[Timesketch]] - tool for collaborative forensic timeline analysis
 +
: http://www.timesketch.org/
  
 
; [[Zeitline]] - Forensic timeline editor
 
; [[Zeitline]] - Forensic timeline editor

Latest revision as of 07:51, 4 April 2015

Timeline formats

Bibliography

Papers

Tools

Aftertime - Java based application for creating timelines
http://www.holmes.nl/NFIlabs/Aftertime/index.html
log2timeline - An artifact timeline creation and analysis framework
http://log2timeline.net
https://blogs.sans.org/computer-forensics/2009/08/13/artifact-timeline-creation-and-analysis-tool-release-log2timeline/
https://blogs.sans.org/computer-forensics/2009/08/14/artifact-timeline-creation-and-analysis-part-2/
Plaso - A toolbox based on log2timeline providing tools to create and analyze timelines
http://plaso.kiddaland.net/
PTK has a timeline analysis tool.
Simile Timeline and Timeplot
http://code.google.com/p/simile-widgets/
sorter - Sleuthkit's MAC times sorting program.
TimeFlow - Visual timelines for investigation - source freely available

https://github.com/FlowingMedia/TimeFlow/wiki/

Timesketch - tool for collaborative forensic timeline analysis
http://www.timesketch.org/
Zeitline - Forensic timeline editor
http://projects.cerias.purdue.edu/forensics/timeline.php
http://sourceforge.net/projects/zeitline/

External Links