Timeline Forensics

Comprehensive timeline forensics skill for creating and analyzing forensic timelines from multiple data sources. Enables super timeline creation, event correlation, anomaly detection, and visualization of activities across disk, memory, network, and log sources.

Capabilities

• Super Timeline Creation: Create comprehensive timelines from multiple sources
• Multi-Source Correlation: Correlate events across different artifact types
• Event Filtering: Filter timelines by time, source, or keyword
• Anomaly Detection: Identify unusual patterns and outliers
• Timeline Visualization: Create interactive timeline visualizations
• Gap Analysis: Identify missing time periods in evidence
• Pivot Point Analysis: Find key events and pivot around them
• Export Formats: Export to CSV, JSON, bodyfile, and other formats
• Timeline Comparison: Compare timelines from different systems
• Activity Clustering: Group related events into activities

Quick Start