http://www.forensicswiki.org/w/index.php?title=Aftertime&feed=atom&action=history 2013-05-19T11:27:00Z Revision history for this page on the wiki MediaWiki 1.20.3 http://www.forensicswiki.org/w/index.php?title=Aftertime&diff=10272&oldid=prev 2010-04-16T06:03:10Z

<p>‎<span dir="auto"><span class="autocomment">Screenshots</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 06:03, 16 April 2010</td> </tr><tr><td colspan="2" class="diff-lineno">Line 98:</td> <td colspan="2" class="diff-lineno">Line 98:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Screenshots==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Screenshots==</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">Screenshots can be found on the </del>[<del class="diffchange diffchange-inline">http</del>:<del class="diffchange diffchange-inline">//www</del>.<del class="diffchange diffchange-inline">holmes.nl/NFIlabs/</del>Aftertime<del class="diffchange diffchange-inline">/screenshots.html screenshots</del>] <del class="diffchange diffchange-inline">section of the </del>[<del class="diffchange diffchange-inline">http</del>:<del class="diffchange diffchange-inline">//www</del>.<del class="diffchange diffchange-inline">holmes.nl/NFIlabs/Aftertime </del>Aftertime]<del class="diffchange diffchange-inline">-website</del>.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>[<ins class="diffchange diffchange-inline">[File</ins>:<ins class="diffchange diffchange-inline">Aftertime1_large</ins>.<ins class="diffchange diffchange-inline">png|200px|thumbs|</ins>Aftertime <ins class="diffchange diffchange-inline">screenshot</ins>]<ins class="diffchange diffchange-inline">]</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>[<ins class="diffchange diffchange-inline">[File</ins>:<ins class="diffchange diffchange-inline">Aftertime2_large</ins>.<ins class="diffchange diffchange-inline">png|200px|thumbs|</ins>Aftertime <ins class="diffchange diffchange-inline">screenshot</ins>]<ins class="diffchange diffchange-inline">]</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">[[File:Aftertime3_large</ins>.<ins class="diffchange diffchange-inline">png|200px|thumbs|Aftertime screenshot]]</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Links==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Links==</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>; [http://www.holmes.nl/NFIlabs/Aftertime/index.html Aftertime website]</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>; [http://www.holmes.nl/NFIlabs/Aftertime/index.html Aftertime website]</div></td></tr> </table>

Vanbaar http://www.forensicswiki.org/w/index.php?title=Aftertime&diff=10271&oldid=prev 2010-04-16T05:59:10Z

<p>Created page with &#039;{{Infobox_Software | name = Aftertime | maintainer = NFI | os = Java | genre = {{Analysis}} | license = proprietary | website = http://www.holmes.nl/NFIlabs/Aftertim…&#039;</p> <p><b>New page</b></p><div>{{Infobox_Software |<br /> name = Aftertime |<br /> maintainer = NFI |<br /> os = Java |<br /> genre = {{Analysis}} |<br /> license = proprietary |<br /> website = http://www.holmes.nl/NFIlabs/Aftertime |<br /> }}<br /> <br /> ==Aftertime==<br /> <br /> '''Aftertime''' is a Java software application that can be used to create [[Timeline_Analysis_Bibliography|time lines]] for forensic investigators. Aftertime is based on [[Snorkel]] to provide access to a large number of image file formats, partition schemes, file systems and file formats. Aftertime not only uses time information contained in the file system but also extracts time information from file contents, e.g. event logs, internet history, e-mail and more. The winners of the [[DFRWS]] [http://www.dfrws.org/2009/challenge/index.shtml 2009 Forensic Challenge] used Aftertime to create the timeline. <br /> <br /> <br /> ==Features==<br /> <br /> With Aftertime it is possible to set the time zone per project, per image, per scanner or change the time zone displayed. The file types supported are summarized below. <br /> <br /> {|<br /> |E-mail<br /> |[[MBox|Mbox]]<br /> |-<br /> |Files<br /> |[[LNK|Shortcuts]]<br /> |-<br /> | <br /> |[[MAC_times|MAC-times]]<br /> |-<br /> |Internet history<br /> |[[Internet_Explorer|Internet Explorer cookies]]<br /> |-<br /> | <br /> |[[Internet_Explorer_History_File_Format|Internet Explorer history]]<br /> |-<br /> | <br /> |[[Apple_Safari_History_File_Format|Safari history]]<br /> |-<br /> | <br /> |[[Safari|Safari cookies]]<br /> |-<br /> | <br /> |[[Opera|Opera cookies]]<br /> |-<br /> | <br /> |[[Firefox|Mozilla/Firefox cookies]]<br /> |-<br /> |<br /> |[[Mozilla_Firefox_History_File_Format|Mozilla]]/[[Mozilla_Firefox_3_History_File_Format|Firefox]] history<br /> |-<br /> |Logs<br /> |[[MSN]]<br /> |-<br /> |<br /> |WTMP<br /> |-<br /> | <br /> |Console kit<br /> |-<br /> | <br /> |Zone alarm<br /> |-<br /> | <br /> |Gator<br /> |-<br /> | <br /> |setupapi.log<br /> |-<br /> | <br /> |WBEM<br /> |-<br /> |Multimedia<br /> |[[Exif]]<br /> |-<br /> |Operating System<br /> |[[EVT|Windows Event log]]<br /> |-<br /> | <br /> |[[Prefetch|Windows Prefetch]]<br /> |-<br /> | <br /> |Linux / Macintosh logs<br /> |-<br /> | <br /> |[[Windows_Registry|Windows Registry]]<br /> |-<br /> |<br /> |Windows Shadow-files<br /> |}<br /> <br /> <br /> ==Examples of use==<br /> Aftertime is used in a wide variety of cases:<br /> * Was a person using this system at a specific time (alibi)?<br /> * Are there traces of malicious activity at a given time?<br /> * Are there any traces of other activity while this file was downloaded?<br /> * When was this letter written?<br /> Aftertime has two different views on the data. The first display is a graphical view, where events are presented in a histogram. It is possible to display the events in a logarithmic scale to not overlook events that are only present a limited number of times. The second display is a list of events with the details of each event presented by highlighting the event.<br /> <br /> ==Screenshots==<br /> Screenshots can be found on the [http://www.holmes.nl/NFIlabs/Aftertime/screenshots.html screenshots] section of the [http://www.holmes.nl/NFIlabs/Aftertime Aftertime]-website.<br /> <br /> ==Links==<br /> ; [http://www.holmes.nl/NFIlabs/Aftertime/index.html Aftertime website]</div>

Vanbaar