O'Reilly logo

Digital Forensics and Incident Response by Gerard Johansen

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Timeline Analysis

When investigating an incident, it is critical to have an idea of when applications or files were executed. Date and timestamps can sometimes be found in other aspects of the investigation, such as when examining memory images. Also, identifying specific DLL files or executable files in the memory image can be compared to the date and time they were accessed, to correlate other activity observed on the system.

Autopsy has functionality specifically for timeline analysis. Simply click on the Timeline button at the top of the window and Autopsy will begin the process of parsing out timeline data. Depending on the size of the image file being analyzed, it may take a few minutes.Once completed, the following window will open: ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required