Log2timeline output...
 
Notifications
Clear all

Log2timeline outputting unreadable data

2 Posts
2 Users
0 Reactions
613 Views
(@condor4)
New Member
Joined: 12 years ago
Posts: 1
Topic starter  

So I'm attempting to create a super timeline of a raw .001 image that was created using FTK Imager v3.4.2.2. While using Plaso/log2timeline v1.4.0 and the basic syntax of log2timeline.exe -z EST5EDT <output> <input>, I keep getting output that is unreadable. When the csv is created, the first line that is created is "PK ¹~xHã3+ serializer.txt+(Ê/É ". I'm currently at a standstill and don't understand why its occurring. I've been bscouring the web looking for a solution but nothing was found. Has anyone experienced this issue with log2timeline at all? if so, please provide insight as to why this may occur and the solution to getting the correct l2t output.


   
Quote
(@deltron)
Estimable Member
Joined: 11 years ago
Posts: 125
 

are you using the sift workstation? If not vm it
Also the cheat sheet
http//digital-forensics.sans.org/media/log2timeline_cheatsheet.pdf


   
ReplyQuote
Share: