Results for “timeline-explorer”

Build forensic super timelines from disk images using Plaso (log2timeline) and triage them in Timesketch.

Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Coordinate multi-stage edge research pipelines from candidate detection through strategy design, review, revision, and export.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.

Generate an XLSX timesheet with logged hours, hourly rates, per-entry amount formulas, and totals for client billing or payroll.

Reporting pipelines for CSV/JSON/Markdown exports with timestamped outputs, summaries, and post-processing.

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.