Results for “timeline-analysis”

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

Analiza series temporales: tendencia, estacionalidad y pronóstico con Prophet, statsmodels y ML, incluyendo descomposición, tests de estacionariedad y evaluación contra baselines.

Compresses long K-line (candlestick) data into a fixed-length sequence using OHLC aggregation rules and applies min-max normalization.

Cleans datasets, detects anomalies, generates reports, and creates visualizations using pandas, scikit-learn, and plotting libraries to turn raw data into client-ready deliverables.

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling.

Reviews a video rough cut by generating deterministic metrics, critiquing the edit against brief and blueprint, and producing review_report.yaml and review_patch.json artifacts.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.