|
|
| Line 1: |
Line 1: |
| − | ==log2timeline==
| + | {{expand}} |
| | | | |
| − | log2timeline is designed as a framework for artifact timeline creation and analysis. The main purpose is to provide a single tool to parse various log files and artifacts found on suspect systems (and supporting systems, such as network equipment) and produce a body file that can be used to create a timeline, using tools such as mactime from TSK, for forensic investigators.
| + | The '''Property List (plist)''' format is widely used within [[Mac OS X]]. It is used to store various kinds of information, e.g. configuration. |
| | | | |
| − | The tool is written in Perl for Linux but has been tested using Mac OS X (10.5.7 and 10.5.8). Parts of it should work natively in Windows as well (with ActiveState Perl installed).
| + | There are multiple format variations of plists: |
| | + | * Binary plist |
| | + | * XML plist |
| | + | * JSON plist |
| | | | |
| − | ==Description== | + | == External Links == |
| − | log2timeline takes a log file (or a directory) and parses it to produce a body file that can be imported into other tools for timeline analysis. The tool has both a modular based approach to the input file as well as the output file. The default behavior of the current version is to export the timeline in a body format readable by TSK's (The SleuthKit) [http://wiki.sleuthkit.org/index.php?title=Body_file mactime] (although this can be easily changed). log2timeline is build as a series of scripts, this one being the front-end, which uses other scripts to actually parse the log files (called modules). The tool is build to be easily extended for anyone that wants to create a new module.
| + | |
| | | | |
| − | The tool contains (current version of 0.51 nightly build (20102608)) three front-ends:
| + | * [http://en.wikipedia.org/wiki/Property_list Wikipedia article on Property list] |
| − | * '''log2timeline''' - The main front-end. A tool capable of parsing a single log file/directory pointed to the tool using a selected input module. | + | * [http://opensource.apple.com/source/CF/CF-550/CFBinaryPList.c CFBinaryPList.c] by Apple |
| − | * '''timescanner''' - A recursive front-end capable of parsing a directory passed to the tool and recursively go through each and every file/dir and try to parse it with every or selected input modules (to provide an automatic method of creating a super timeline). | + | * [http://explanatorygap.net/2009/10/30/apple-have-documented-the-binary-plist-format/ Apple have documented the binary plist format] |
| − | * '''glog2timeline''' - A simple GUI front-end, with similar capabilities as log2timeline (the main front-end) | + | * [http://digitalinvestigation.wordpress.com/2012/03/08/free-python-module/ Python Module for dealing with Binary Property Lists (bplists)] Documentation |
| | + | * [http://www.ccl-forensics.com/images/property%20lists%20in%20digital%20forensics%20new.pdf Property Lists in Digital Forensics], by Alex Caithness, 2010 |
| | | | |
| − | ==Currently Supported Input Modules== | + | == Tools == |
| | + | * [https://github.com/JonathanBeck/libplist libplist] |
| | + | * [http://scw.us/iPhone/plutil/ plutil.pl] |
| | + | * [http://code.google.com/p/ccl-bplist/ Python Module for dealing with Binary Property Lists (bplists)] |
| | + | * [http://code.google.com/p/munki/ munki - Managed software installation for OS X] comes with code to handle binary plists |
| | | | |
| − | The currently supported input modules (as of version 0.51 nightly build (20102608)) are:
| + | [[Category:File Formats]] |
| − | | + | |
| − | * '''apache2_access''' - Parse the content of a Apache2 access log file
| + | |
| − | * '''apache2_error''' - Parse the content of a Apache2 error log file
| + | |
| − | * '''chrome''' - Parse the content of a Chrome history file
| + | |
| − | * '''evt''' - Parse the content of a Windows 2k/XP/2k3 Event Log
| + | |
| − | * '''evtx''' - Parse the content of a Windows Event Log File (EVTX)
| + | |
| − | * '''exif''' - Extract metadata information from files using ExifTool
| + | |
| − | * '''ff_bookmark''' - Parse the content of a Firefox bookmark file
| + | |
| − | * '''firefox2''' - Parse the content of a Firefox 2 browser history
| + | |
| − | * '''firefox3''' - Parse the content of a Firefox 3 history file
| + | |
| − | * '''iehistory''' - Parse the content of an index.dat file containg IE history
| + | |
| − | * '''iis''' - Parse the content of a IIS W3C log file
| + | |
| − | * '''isatxt''' - Parse the content of a ISA text export log file
| + | |
| − | * '''mactime''' - Parse the content of a body file in the mactime format
| + | |
| − | * '''mcafee''' - Parse the content of a log file
| + | |
| − | * '''opera''' - Parse the content of an Opera's global history file
| + | |
| − | * '''oxml''' - Parse the content of an OpenXML document (Office 2007 documents)
| + | |
| − | * '''pcap''' - Parse the content of a PCAP file
| + | |
| − | * '''pdf''' - Parse some of the available PDF document metadata
| + | |
| − | * '''prefetch''' - Parse the content of the Prefetch directory
| + | |
| − | * '''recycler''' - Parse the content of the recycle bin directory
| + | |
| − | * '''restore''' - Parse the content of the restore point directory
| + | |
| − | * '''setupapi''' - Parse the content of the SetupAPI log file in Windows XP
| + | |
| − | * '''sol''' - Parse the content of a .sol (LSO) or a Flash cookie file
| + | |
| − | * '''squid''' - Parse the content of a Squid access log (http_emulate off)
| + | |
| − | * '''syslog''' - Parse the content of a Linux Syslog log file
| + | |
| − | * '''tln''' - Parse the content of a body file in the TLN format
| + | |
| − | * '''userassist''' - Parses the NTUSER.DAT registry file
| + | |
| − | * '''volatility''' - Parse the content of a Volatility output files (psscan2, sockscan2, ...)
| + | |
| − | * '''win_link''' - Parse the content of a Windows shortcut file (or a link file)
| + | |
| − | * '''wmiprov''' - Parse the content of the wmiprov log file
| + | |
| − | * '''xpfirewall''' - Parse the content of a XP Firewall log
| + | |
| − | | + | |
| − | ==Links==
| + | |
| − | ; [http://log2timeline.net log2timeline web site]
| + | |
| − | ; [http://www.sans.org/reading_room/whitepapers/logging/mastering-super-timeline-log2timeline_33438 SANS GCFA Gold paper about the tool]
| + | |
| − | ; [http://blogs.sans.org/computer-forensics/2010/03/19/digital-forensic-sifting-super-timeline-analysis-and-creation/ A quick run on how to create a super timeline]
| + | |
| − | ; [http://blog.kiddaland.net/2009/08/log2timeline-artifact-timeline-analysis-part-i/ A blog post introducing the tool]
| + | |
| − | ; [https://blogs.sans.org/computer-forensics/2009/08/13/artifact-timeline-creation-and-analysis-tool-release-log2timeline/ Part 1 of the SANS Forensic blog post about the tool]
| + | |
| − | ; [https://blogs.sans.org/computer-forensics/2009/08/14/artifact-timeline-creation-and-analysis-part-2/ Part 2 of the SANS forensic blog post about the tool]
| + | |
