Would it be great to have a feature in FTK to build an automatic timeline based on MAC dates for files, OS event log entries, internet history and email messages activity all in a single timeline with filter capabilities, for specific timeframes (Hours, days, weeks, months, years, etc.)
Very similar to what Autopsy does
Is it possible to build that feature in FTK?
Thanks in advance
Hector Cuchilla
Agreed
Voted.
IEF does something similar as well with their Timeline analyzer.
Can you post or email me directly and screenshots with examples? Thank you for the feedback.
Hi Tod,
I don't see your email address, can you share it please and I will send screenshots of this feature in Autopsy.
My contact info
Hector Cuchilla
hector.cuchilla@teleperformance.com
Tod,
Here is how IEF does it.
https://www.magnetforensics.com/computer-forensics/using-ief-v6-new-timeline-feature/
Cheers,
Yian
Here is how Autopsy does it:
https://www.sleuthkit.org/autopsy/timeline.php
https://www.sleuthkit.org/autopsy/images/v3/tl_counts.png
Best Regards,
Hector Cuchilla
Has anyone looked at how Truxton Forensics does this and other automatic reports, very easy to understand.
https://www.truxtonforensics.com/features
Regards,
Mike Grieveson
Thank you for all the examples and feedback, I will put this together for development review.
Thank you Tod,
Please don't hesitate in contact me if you need additional information or samples.
Atentamente / Best Regards,
Hector Cuchilla CVA, CDFE, CNFE, CPTE
Physical Security Manager
Teleperformance El Salvador
Nearshore Region
ASIS ID: 18705708