Autotimeliner tool will automagically extract forensic timeline from volatile memory dumps.
(Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5)
AutoTimeline automates this workflow:
Simply clone the GitHub repository:
git clone https://github.com/andreafortuna/autotimeliner.git
autotimeline.py [-h] -f IMAGEFILE [-t TIMEFRAME] [-p CUSTOMPROFILE]
optional arguments:
-h, –help show this help message and exit
-f IMAGEFILE, –imagefile IMAGEFILE
Memory dump file
-t TIMEFRAME, –timeframe TIMEFRAME
Timeframe used to filter the timeline (YYYY-MM-DD
..YYYY-MM-DD)
-p CUSTOMPROFILE, –customprofile CUSTOMPROFILE
Jump image identification and use a custom memory
profile
Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21:
./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21
Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21:
./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21
Extract timeline from TargetServerMemory.raw, using a custom memory profile:
./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64
All timelines will be saved as $ORIGINALFILENAME-timeline.csv.
WID_LoadLibrary is a custom implementation inspired by the Windows API function LoadLibrary, which is used…
Locksmith is a specialized tool designed to identify and remediate vulnerabilities in Active Directory Certificate…
Uscrapper Vanta is a powerful open-source intelligence (OSINT) tool designed to revolutionize web scraping and…
Pake is an innovative tool designed to convert any webpage into a desktop application with…
Bevy is an open-source, data-driven game engine built in Rust, designed to simplify game development…
AppFlowy Cloud is a robust component of the AppFlowy ecosystem, designed to provide secure user…