log2timeline Since 2009 - SANS

SANS 2011 Digital Forensics and Incident Response Summit
Other methods
Sequential MFT entry number allocation
Malware often hides inside Windows\System32
Patches update several files
Malware introduces few changes
What l2t_process does to detect manipulations
$MFT module includes notes if entries are suspicious
The i (include) option includes suspicious entries
outside the date range
Maps the relationship between MFT entry nr. and
creation time