Results for “timestamp”

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Build forensic super timelines from disk images using Plaso (log2timeline) and triage them in Timesketch.

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.