Bruce Nikkel timelines.pdf
Bruce Nikkel timelines.pdf
Bruce Nikkel timelines.pdf
11
0.0 (0)
R. Z.
R. Z.
This flashcard set delves into the intricacies of timestamps and timelines, focusing on their role in digital forensics at a university level. It covers key concepts like timestamps, supertimelines, and tools such as mactime and log2timeline/plaso, exploring their applications in reconstructing past events. The flashcards also address challenges like clock drift, timezone issues, and anti-forensic activities, making it invaluable for students and professionals in computer science who need to understand and analyze digital evidence effectively.
Cartes-fiches
11
Utilisateurs
2
Langue
Anglais
Catégorie
Informatique
Niveau
Université
Créé / Mis à jour
20.06.2019 / 01.07.2020
-
- 1 / 11
-
Cartes-fiches
What is a "supertimeline"?
A "supertimeline" brings timestamps from multiple sources together.
Name some sources for of timestamps that can be used in a supertimeline?
- filesystem timestamps (MACB)
- logs (syslog, MS event, application, firewall, AV)
- browser history, cookies, cache, bookmarks
- Windows registry
- email files
- office docs
- exif data (metadata from pics/vids)
- recycle/trash bins
- Win prefeth, restore, TLN, LNK files, other MS formats
- volatility output files
- captured network traffic (PCAP files)
Name a tool that can be used to generate a supertimeline.
log2time/plaso is a python supertimeline framework, has many parsers to extract timestamps from differnt file types.
