log2timeline Since 2009 - SANS

More documents

Recommendations

Info

SANS 2011 Digital Forensics and Incident Response Summit The old method timescanner z ZONE d MNTPOINT w BODYFILE fls r m C: IMAGE >> BODYFILE regtime.pl m HKLM-SYSTEM r MNTPOINT/WINDOWS/System32/config/system >> BODYFILE regtime.pl m HKLM-SAM r MNTPOINT/WINDOWS/System32/config/SAM>> BODYFILE regtime.pl m HKLM-SECURITYr MNTPOINT/WINDOWS/System32/config/SECURITY >> BODYFILE regtime.pl m HKLM-SOFTWAREr MNTPOINT/WINDOWS/System32/config/software >> BODYFILE mactime d b BODYYFILE z ZONE DATE_RANGE > CSVFILE
SANS 2011 Digital Forensics and Incident Response Summit The new (although manual) ntfs-3g does not show the $MFT file Need to extract the $MFT icat myimage.dd 0 > myimage.mft log2timeline f mft z EST5EDT m C: -w /cases/bodyfile.txt log2timeline f winxp z EST5EDT m C: -r p /mnt/windows_mount w /cases/bodyfile.txt l2t_process b /cases/bodyfile.txt 01-15-2010..01-25-2010 > /cases/timeline.txt
Page 1 and 2: log2timeline - helping you to creat
Page 3 and 4: SANS 2011 Digital Forensics and Inc
Page 23: SANS 2011 Digital Forensics and Inc
Page 29 and 30: and then what?
Page 37 and 38: Scatter Plots [2139] /WINDOWS/syste

log2timeline Since 2009 - SANS

Create successful ePaper yourself

Delete template?

Save as template?