Results for “forensic-timeline”
18 skills
mukul975 performing-timeline-reconstruction-with-plaso
Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.
24.6k · bundle
mukul975 generating-forensic-timelines-with-hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
mukul975 performing-disk-forensics-investigation
Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.
24.6k · bundle
mukul975 building-super-timelines-with-plaso
Build forensic super timelines from disk images using Plaso (log2timeline) and triage them in Timesketch.
24.6k · bundle
mukul975 building-incident-timeline-with-timesketch
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
24.6k · bundle
mukul975 analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
24.6k · bundle
More results
mukul975 analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
24.6k · bundle
mukul975 parsing-artifacts-with-eric-zimmerman-tools
Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.
24.6k · bundle
mukul975 analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
24.6k · bundle
mukul975 analyzing-browser-forensics-with-hindsight
Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.
24.6k · bundle
mukul975 performing-linux-log-forensics-investigation
Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.
24.6k · bundle
mukul975 hunting-for-defense-evasion-via-timestomping
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.
24.6k · bundle
mukul975 extracting-browser-history-artifacts
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
24.6k · bundle
mukul975 performing-cloud-log-forensics-with-athena
Query AWS CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena for forensic investigation of security incidents.
24.6k · bundle
mukul975 performing-windows-artifact-analysis-with-eric-zimmerman-too
Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.
24.6k · bundle
mukul975 performing-insider-threat-investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.
24.6k · bundle
mukul975 analyzing-windows-prefetch-with-python
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
24.6k · bundle
mukul975 analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.
24.6k · bundle