autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

ma2tl

ma2tl macapt to timeline This is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of macapt. Requirements Python 3.7.0 or later pytz tzlocal xlsxwriter Installation % git clone https://github.com/mnrkbys/ma2tl.git Usage % python ./ma2tl.py -h usage: ma2tl.py -h -i...

DFIR-Companion

DFIR Companion AI-assisted DFIR triage — on your machine. Turns investigation screenshots and imported artifacts into a forensic timeline, findings, IOCs, an asset↔IoC graph, and shareable reports; ask the case questions in plain English and collaborate with other investigators. A localhost...

autotimeliner

AutoTimeliner Extrae automágicamente una línea de tiempo forense de volcados de memoria volátil. AutoTimeliner ejecuta múltiples plugins de Volatility3 contra imágenes de memoria de Windows, Linux y macOS, y luego fusiona sus salidas en una única línea de tiempo CSV ordenada: Plugin de línea de...

ma2tl

ma2tl macapt a timeline Esta es una herramienta DFIR para generar una línea de tiempo forense de macOS a partir de las bases de datos de resultados de análisis de macapt. Requisitos Python 3.7.0 o posterior pytz tzlocal xlsxwriter Instalación % git clone https://github.com/mnrkbys/ma2tl.git Uso %...

timesketch

Timesketch Indice 1. Informazioni su Timesketch 2. Per iniziare 3. Community 4. Contribuire Informazioni su Timesketch Timesketch è uno strumento open-source per l'analisi collaborativa di timeline forensi. Utilizzando gli sketch, tu e i tuoi collaboratori potete organizzare facilmente le vostre...

irflow-timeline v1.0.13

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

irflow-timeline v1.0.12

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

Crow-Eye v0.12.7

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...

Active Directory Honeytoken Tripwire: DCEPT

DCEPT D omain C ontroller E nticing P assword T ripwire is a honeytoken-based tripwire for Microsoft’s Active Directory. Honeytokens are pieces of information intentionally littered on system so they can be discovered by an intruder. In the case of DCEPT, the honeytokens are credentials that woul...