log2timeline Since 2009 - SANS

SANS 2011 Digital Forensics and Incident Response Summit
How to Create a Front-‐end?
#!/usr/bin/perl
use Log2Timeline;; # import the library that contains the log2timeline engine
my $l = Log2Timeline->new(
=> '/mnt/analyze', # point to the file/directory to parse
' => 1, # we want to recursively go through stuf
#'hostname' => '', # to include a hostname (done in preprocessing)
'input' => 'winxp', # which input modules to use (this is a Win XP machine)
'output' => 'csv', # what is the output module to be used
#'offset' => 0, # the time offset (if the time is wrong) 2996
#'exclusions' => '', # an exclusion list of one exists
#'text' => '', # text to prepend to path of files (like c:)
#'append' => 0, # we are appending to an output file, instead of writing a new one
'time_zone' => 'CST6CDT', # the time zone of the image
'preprocess' => 1, # turn on pre-processing modules
) or die( 'unable to start log2timeline');;
$l->start;;
sub print_line($)
{
my $line = shift;;
print $line;;
}