“timeline-analysis”的搜索结果

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.

中文简介正在准备中。当前显示英语简介。

• Checking whether a suspicious program ran
• Building a timeline of investigative tool findings
• Investigating compression and file transfer tool usage

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

中文简介正在准备中。当前显示原文说明。

Generate log2timeline and Plaso super-timelines and triage them in Timesketch.

中文简介正在准备中。当前显示原文说明。

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

中文简介正在准备中。当前显示原文说明。

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

中文简介正在准备中。当前显示原文说明。

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

中文简介正在准备中。当前显示原文说明。

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

中文简介正在准备中。当前显示原文说明。

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

中文简介正在准备中。当前显示原文说明。