acquiredsecurity/forensic-timeliner

Source: GitHub Author: unknown URL: https://github.com/acquiredsecurity/forensic-timeliner

  1. ONE SENTENCE SUMMARY: Forensic Timeliner is a PowerShell tool that consolidates and formats forensic data into a sortable, analyzable master timeline.

  2. MAIN POINTS:

  3. Aggregates data from Chainsaw, KAPE/EZTools, and WebHistoryView into a unified timeline.

  4. Normalizes artifact data fields for consistent formatting across different sources.

  5. Supports output in CSV, JSON, and XLSX formats with optional color-coded Excel macro.

  6. Offers interactive and batch modes for ease of use and scalability.

  7. Filters MFT and event logs using customizable criteria to prioritize relevant data.

  8. Deduplicates timeline entries and supports filtering by date range.

  9. Categorizes web activity into search, download, file access, and general browsing.

  10. Uses StreamReader to handle large datasets efficiently by processing in 10,000-line batches.

  11. Exports include detailed metadata like file size, SHA1, user, computer, and command line.

  12. Fully customizable via parameters or script modification for tailored forensic workflows.

  13. TAKEAWAYS:

  14. Simplifies forensic triage by unifying outputs from multiple tools into a single timeline.

  15. Highly customizable filtering and mapping improve data relevance and clarity.

  16. Interactive mode enables quick setup for new investigations.

  17. Supports large-scale processing with batch mode and efficient file reading.

  18. Designed specifically for forensic analysts leveraging the SANS KAPE standard.