Tools timeline analysis
Timeline analysis tooling for creating, exchanging, analyzing and visualizing timelines from the timestamped artifacts found on a computer system. The tools below are grouped according to the categories of timeline analysis described in Timeline analysis.
Warning: The tools listed below are not necessarily forensic tooling in the sense of Forensic tooling.
Timeline creation
See also Timeline creation.
Plaso (Plaso Langar Að Safna Öllu), or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creating more targeted timelines. It parses file systems, Windows Registry data, log files and application artifacts into a single correlated timeline, whose output is then imported into Timesketch for collaborative analysis.
The body file output of fls can be used as the input of the
mactime sorting program, which produces a chronologically sorted
mactime timeline of a file system.
fiwalk is a batch forensics analysis program built on The Sleuth Kit.
It walks a disk image and outputs a Digital Forensics XML
record of every file with its MAC times; the companion idifference.py
(forensic disk differencing) compares two images of
the same disk and produces a timeline of changes between them.
RECON for Mac OS X is a commercial triage suite for Mac OS X developed by SUMURI that automatically finds, parses and unifies important artifacts into a refined timeline; advertised features include advanced timeline analysis and automatic chat timeline construction for Messages and Skype.
ExifTool is a general-purpose metadata extraction tool used to pull timestamped EXIF
metadata out of images; log2timeline used it in its exif input
module. It is also the common cross-check for timestamped image metadata produced
by tools such as EXIF Hound.
A Win32 command line tool that parses Sticky Notes
(stickynotes.snt) files; its output can be a listing of the available notes, or in
CSV and TLN format for inclusion in a timeline of system activity.
A browser history extraction tool - it is listed in the Firefox 3 history file format article alongside log2timeline and Plaso - that extracts visit histories with timestamps into a format suitable for timeline analysis.
graverobber, a tool of The Coroner's Toolkit
(TCT), is the origin of the body file format, which was adopted by
The Sleuth Kit. TCT was superseded by The Sleuth Kit,
and graverobber's role in timeline creation was taken over by TSK's fls/mactime and
later by Plaso. Discontinued.
Log2timeline is an artifact timeline creation and analysis framework, with modular input and output support for body file, TLN, l2t CSV and more. Log2timeline has been superseded by Plaso and is no longer maintained.
Analyzing timelines
See also Analyzing timelines.
Timesketch is a tool for collaborative forensic timeline analysis. Using sketches you and your collaborators can easily organize your timelines and analyze them all at the same time. Add meaning to your raw data with rich annotations, comments, tags and stars.
logstash is a tool for managing events and logs: it collects, parses and stores logs for later use, and includes a web interface for searching and drilling into them. It is listed under timeline correlation in the network forensics tools article.
MailXaminer is a commercial Windows-based e-mail and messaging data analysis tool whose feature list includes timeline analysis of searches - chats, mails and more.
PALADIN is a free, "live" Linux forensic toolkit from SUMURI that bundles 100+ open source tools in toolboxes that include timeline analysis, log analysis and The Sleuth Kit.
EXIF Hound is a free, open source desktop application for inspecting EXIF metadata in images and plotting GPS coordinates; it supports reconstructing where and in what order photos were taken, and exports metadata as CSV or JSON "for timelines and reports".
4n6time, formerly "l2t_Review", was a free, cross-platform forensic tool for timeline creation and review. It appears to be abandoned.
Visualizing timelines
See also Visualizing timelines.
Zeitline is a forensic timeline editor, a desktop tool for reviewing, filtering and annotating timelines. The project appears to be abandoned.
TimeFlow produces visual timelines for an investigation; its source is freely available. The project appears to be abandoned.
Simile provides browser-based widgets (timeline, timeplot) that sort and render timeline data. The project has been archived.