How to do it...

At first glance, you will see a bar graph which shows the number of things that have taken place each year. Clicking on a given year will break that period down into months; clicking on a particular month will break the timeline down into days; then, finally, clicking on days will bring you an hour-by-hour timeline view. There are currently no more granular levels than this. The following image shows a timeline broken down by month:

Fig. 11.1. The timeline view in Autopsy .

The procedure to prepare a timeline in Autopsy:

  1. Once you have chosen your time period, you will be able to visualize any relevant data in the bottom left-hand ...

Get Windows Forensics Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.