12 · Timeline Analysis
Building a Super Timeline with Plaso
Build and filter a Windows super timeline with Plaso: log2timeline, psteal and psort flags, time zones, MACB, Timeline Explorer, EZ Tools CSVs and pivoting.
Area 12
Timeline Analysis
Timelines are where individual artifacts become a story. This area covers building super-timelines with Plaso, targeted mini-timelines from EZ Tools output, timezone normalisation, MACB semantics and the pivoting habits that turn thousands of rows into a defensible sequence of events.
Key sources
- Plaso
- Timeline Explorer
- MACB
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Master File Table ($MFT)$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.
- USN Journal ($UsnJrnl:$J)USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.