Autotimeliner - Automagically Extract Forensic Timeline From Volatile Memory Dump

Automagically extract forensic timeline from volatile memory dumps. Requirements Python 3 Volatility mactime from SleuthKit Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5 How it works AutoTimeline automates this workflow: Identify correct volatility profile for the...

Fedora 18 : sleuthkit-4.0.1-1.fc18 (2013-0320)

New Features: More DOS partition types are displayed. Added fcat tool that takes in file name and exports content equivalent to using ifind and icat together. performance improvements with FAT code maps and diradd performance improvements with NTFS code maps added AONLY flag to blockwalk Updated...