Generating computer forensic supertimelines under Linux: A comprehensive guide for Windows-based disk images

When the authors first published this paper, their intentions were to develop a comprehensive guide to digital forensic timelines in order to consolidate the many fragmented sources of information concerning this topic.  What they discovered, however, was that quality references were often challenging to find among various books, papers, periodicals, filesystem specifications and source code.

While conducting their research, they found that practical tool-based solutions existed for generating digital forensic timelines, though they each had specific limitations.  Thus, efforts were undertaken by the authors to provide an alternative timeline generation framework.  Although some in the community had already proposed the use and generation of supertimelines, all too often important data sources were being left out.  In order to rectify this, it became necessary to couple additional tools in order to provide maximum evidentiary extraction.

Even though the leading date/time extraction software, The Sleuth Kit (TSK) and Log2timeline (and timescanner) are excellent tools in their own right, they require each other in order to create supertimelines.  Whereas Log2timeline’s timescanner provides automated disk image processing capabilities, it nonetheless has certain difficulties handling specific supported file formats.  As such, the authors’ proposed framework combines the best features of TSK, Log2timeline (while avoiding timescanner), additional date/time extraction software and shell scripting to deliver an improved supertimeline generation framework.  The proposed framework is largely automated once the correct parameters have been provided to the script.  Though it does not support all the same datasets as Log2timeline, this prototype can be readily augmented to provide the same dataset functionality as Log2timeline.  The proposed prototype, although specifically written for handling Windows-based disk images, could be readily modified to support various other filesystem formats.

The forensic investigator, equipped with the various in-depth sources of information provided by the authors’ paper, coupled with the prototype supertimeline generation script, should provide sufficient timeline generation capability for most Windows-based disk investigations.

Click here for the report: Generating computer forensic supertimelines under Linux – A comprehensive guide for Windows-based disk images.pdf

All Shell (Bash) and C source code are persuant to the following Disclaimer and Licensing Agreement.  Use of this prototype code assumes that the user/reader agrees to the conditions set forth and is bound by them,  If the user/reader does not agree, do not use the code.

Click here for the Bash script timeline.sh.

Click here C code file_name_type_line_parser.c.

Click here for C code find_signature_evtlog.c.

Click here for C code unixtime_to_systime.c.