Blog: SANS Digital Forensics and Incident Response Blog

Blog: SANS Digital Forensics and Incident Response Blog

Digital Forensic SIFTing: Colorized Super Timeline Template for Log2timeline Output Files

Last Month at the SANS360, I promised the release of the Timeline Template to be used to automatically colorize your timelines.

Review on Timeline Creation:


1.Mounting Evidence Files

2.Automated Timeline Creation

3. Targeted Timeline Creation

TIMELINE CREATION CHEAT SHEET

The Timeline Color Template in EXCEL 2007+


The EXCEL TEMPLATE can be downloaded here. TIMELINE_COLOR_TEMPLATE

MD5 = fa31f465a458d7949c1cddfa49d5be3c *TIMELINE_COLOR_TEMPLATE.zip

To use the template you must currently use MS EXCEL 2007 or higher. Hopefully we can get other formats of this created, but think this is a start to help out with analysis of log2timeline data.

To learn how to create timelines: Read these articles

 

  1. Download it - Open Timeline Color Template
  2. Switch to Color Timeline worksheet/tab
  3. Click on Cell A-1
  4. Select 'DATA' Ribbon
  5. Import Data "FROM TEXT"
  6. Select log2timeline.csv file
  7. TEXT IMPORT WIZARD Will Start
  8. Step 1 -> Select Delimited ->Select NEXT
  9. Step 2 -> Unselect Tab under Delimiters -> Select Comma under Delimiters -> Select NEXT >
  10. Step 3 ->Select Finish
  11. Where do you want to put the data? Simply Select OK.
  12. Once imported View -> Freeze Panes -> Freeze Top Row
  13. Optional Hide Columns Timzone, User, Host, Short or Desc (keep one of these), Version
  14. Select HOME Ribbon
  15. Select all Cells "CTRL-A"
  16. In Home Ribbon -> Sort and Filter - Filter
Begin Analysis:

Your chart should now look like this once you start filtering your data to the elements you are looking for.

Another Example

This chart will also help you with analysis of the colorized artifacts from our FOR408 Windows In-Depth Course

To select specific artifacts of interest you can select them from the source, sourcetype, type, or short columns. Below is an example of FILTERING using the drop down filter for the Sourcetype column. If you wanted look for specific data types and eliminate others, this is a great place to start.

More articles on analysis techniques are coming, but the color spreadsheet needs some polish still. If you have feedback, please email me at rlee "at" sans.org with feedback or updates that can make it even better.

Rob Lee has over 15 years of experience in digital forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute and lead author for FOR408 Windows Forensics and FOR508 Advanced Computer Forensics Analysis and Incident Response.

6 Comments

Posted January 25, 2012 at 3:00 PM | Permalink | Reply

Tom Yarrish

Rob,
Thanks as always for doing this, a couple of things to make the instructions a bit clearer:

Step 2 -> Open Timeline Color Template
Step 3 -> Switch to Color Timeline worksheet/tab

I don't think Step 15 is needed, by default it should filter on the header row, since you froze it.

You might also think for v2 to make it an actual template file instead of a xslx file. I'm guessing someone has already done that...

One question, how did you get the memory entries into the timeline example you showed? Are you using the timeline plug in to Volatility that gleeda made?

But awesome job thank you...

Tom

Posted January 25, 2012 at 5:43 PM | Permalink | Reply

robtlee

Changed.

Making it a template shouldn't be that hard. To be honest, I forgot you could do that.

For the memory, yes that incorporates the timeliner output from volatility by Gleeda. Wrote her to see if I don't have to do it by hand next time by having her output dump into something log2timeline can slurp. Otherwise we will need a plugin.

--Rob

Posted January 26, 2012 at 2:51 PM | Permalink | Reply

Kevin

Rob, Is there any reasoning behind why the entire row is sometimes not colored?

Posted March 03, 2012 at 8:56 PM | Permalink | Reply

David Nides (dav nads)

Rob,

I noticed in the first graphic in row one you had a source type item of "Email PST".

Was this something you manually added to the timeline or some type of plugin not part of the standard log2timeline?

Thanks,

David Nides

Posted March 05, 2012 at 2:26 AM | Permalink | Reply

robtlee

It was something I added to clarify the point. However, Im working on a basic extractor using libpff. The hard part is that email timestamps are an odd beast and show when the server recieved it. Im trying to determine if there is any log that captures when it was read.

Posted August 06, 2012 at 1:58 PM | Permalink | Reply

yildirim

Is there a similar template for openofice/libreoffice?

Post a Comment






* Indicates a required field.