Timeline
Plaso
log2timeline is a command line tool to extract events from individual files, recursing a directory (e.g. mount point) or storage media image or device. log2timeline creates a plaso storage file which can be analyzed with the pinfo and psort tools.
psort is a command line tool to post-process plaso storage files. It allows you to filter, sort and run automatic analysis on the contents of plaso storage files.
psteal is a command line tool that combines the functionality of log2timeline and psort.
psteal.py
This will produce a csv file containing all the events from an image
log2timeline (1st step)
Sometimes you may not want to do a complete timeline that extracts events from every discovered file. To do a more targeted timelining, the -f FILTER_FILE parameter can be used.
I usually use the filter_windows.yaml to shorten the loading time for all windows image
psort (2nd step)
I usually use the date filter to filter away the irrelevant date in this step
To see a list of support format
Docker
Also we can use docker to run log2timeline and psort as it is the latest version and we don't need to bother with the dependencies
Install docker from docker hub
Run it from your directory (mount your data directory to docker container's volume (i.e. /data)
Timeline Explorer / Elasticsearch (3rd step)
Upload to elasticsearch via commandline
Output as csv
When output with csv, we can open it with Eric Zimmermen's Timeline Explorer (see below)
Timeline Explorer by Eric Zimmerman
Load your combined csv into Timeline Explorer with <Open>
Search with the filter or power filter
Shortcut key
Several useful shortcuts include:
CTRL-t: Tag or untag selected rows
CTRL-d: Bring up the Details window for super timelines
CTRL-C: Copy the selected cells (with headers) to the clipboard. Hold SHIFT to exclude the column header
Timesketch
Install timesketch using docker. The detailed steps in https://github.com/google/timesketch/blob/master/docs/Installation.md
Create a case after logging in https://127.0.0.1:5000
Upload data using timesketch api
Upload data with Python
importing python libraries
connect to your timesketch server with your server ip, username and password
code to enumerate sketch
Output
set target sketch
use a streamer to upload the data to the server
Search queries for timesketch
File Download Capabilities
Program Execution Analysis
Deleted Files or File Knowledge
Network Activity and Physical Locations
File/Folder Opening
Account Usage
External Devices, Storage
Browser Usage
Python code for searching on TimeSketch with jupyter notebook
import the necessary libraries for searching
First way of searching is to use the explore function
Second way of searching
DateRangeClip object is used to control the date range of the output of the query
How to create a timeline from harddrive image and memory dump with SleutKit and Volatility's timeliner plugin?
SleutKit
Extract filesystem bodyfile from .E01 file
Volatility
Run the timeliner plugin against image file
Run the mftparser volatility plugin
Combine the memory timeline and mftparser timeline to the filesytem bodyfile
Extract the combined filesystem and memory timeline
Apply whitelist
How to create a supertime line with log2timeline?
Process memory image with Volatility Timeliner, Shellbags, and MFT modules into a single memory timeline body file.
Process E01 image timeline data with log2timeline into a plaso dump file with selected parsers.
Process the memory body file into the plaso dump file with the mactime body parser.
Sort the data with psort into a CSV.
Filter the CSV to remove excess Windows noise if desired.
Create body file with Volatility
The MFT module will carve out Master File Table residue that was in memory at the time of capture.
The Shellbags mdoule will retrieve registry information regarding Windows GUI settings for Explorer that were stored in memory.
The timeliner plugin helps investigators by providing a timeline of all the events that took place when the image was acquired.
The timeliner plugin groups details by time and includes process, PID, process offset, DDLs used, registry details, and other useful information.
Volatility 2
Volatility 3
Combine the body file
Timeline Dump file Creation
Triage
Creating a Triage style Super Timeline is easy. Simply using the premade filter included with Log2timeline will generate a great timeline to effectively triage a disk image.
The filter is located at /usr/share/plaso/filter_windows.txt
and is designated with the -f
switch. As stated above, this filter will filter on (extract) the following items:
MFT
NTFS LogFile
UsnJrnl
Recycle bin artifacts
Windows Registry files
Recent file activity
Jump List Files
Windows Event Logs
Windows Artifacts
Prefetch files
Browser History Artifacts
Target Timeline
Parse winevtx, bagmru, usnjrnl, prefectch, amcache, winreg_default, SRUM. Add to memory with mactime parser. Run the commands in order.
Supertimeline
Last updated