Super timeline all the things
log2timeline/plaso 的主要功能包括：Timeline Analysis, Forensics and Incident Response, Digital Forensics, Timeline Analysis Tools。
log2timeline/plaso 的开源替代品包括： google/timesketch — Collaborative forensic timeline analysis. log2timeline/dftimewolf — A framework for orchestrating forensic collection, processing and data export. velocidex/velociraptor — Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and… dfirkuiper/kuiper — Digital Forensics Investigation Platform. cyb3rfox/aurora-incident-response. airbus-cert/timeliner — A rewrite of mactime, a bodyfile reader.
A framework for orchestrating forensic collection, processing and data export
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools (https://github.com/ANSSI-FR/bmc-tools) as input, it provides a graphical user interface and…
