GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → andreafortuna → Autotimeliner

andreafortuna / Autotimeliner

Licence: mit
Automagically extract forensic timeline from volatile memory dump

Programming Languages

python
139335 projects - #7 most used programming language

Labels

dfirforensics

Projects that are alternatives of or similar to Autotimeliner

Memlabs
Educational, CTF-styled labs for individuals interested in Memory Forensics
Stars: ✭ 696 (+1188.89%)
Mutual labels:  dfir, forensics
truehunter
Truehunter
Stars: ✭ 30 (-44.44%)
Mutual labels:  forensics, dfir
smram parse
System Management RAM analysis tool
Stars: ✭ 50 (-7.41%)
Mutual labels:  forensics, dfir
PSTrace
Trace ScriptBlock execution for powershell v2
Stars: ✭ 38 (-29.63%)
Mutual labels:  forensics, dfir
Swap digger
swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.
Stars: ✭ 354 (+555.56%)
Mutual labels:  dfir, forensics
EventTranscriptParser
Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)
Stars: ✭ 22 (-59.26%)
Mutual labels:  forensics, dfir
ir scripts
incident response scripts
Stars: ✭ 17 (-68.52%)
Mutual labels:  forensics, dfir
uac
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Stars: ✭ 260 (+381.48%)
Mutual labels:  forensics, dfir
Mac apt
macOS Artifact Parsing Tool
Stars: ✭ 329 (+509.26%)
Mutual labels:  dfir, forensics
Ir Rescue
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Stars: ✭ 311 (+475.93%)
Mutual labels:  dfir, forensics
DFIR-O365RC
PowerShell module for Office 365 and Azure log collection
Stars: ✭ 158 (+192.59%)
Mutual labels:  forensics, dfir
Diffy
Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Stars: ✭ 555 (+927.78%)
Mutual labels:  dfir, forensics
ad-privileged-audit
Provides various Windows Server Active Directory (AD) security-focused reports.
Stars: ✭ 42 (-22.22%)
Mutual labels:  forensics, dfir
WELA
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
Stars: ✭ 442 (+718.52%)
Mutual labels:  forensics, dfir
iTunes Backup Reader
Python 3 Script to parse out iTunes backups
Stars: ✭ 108 (+100%)
Mutual labels:  forensics, dfir
LevelDBDumper
Dumps all of the Key/Value pairs from a LevelDB database
Stars: ✭ 23 (-57.41%)
Mutual labels:  forensics, dfir
MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (+314.81%)
Mutual labels:  forensics, dfir
CDIR
CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library
Stars: ✭ 122 (+125.93%)
Mutual labels:  forensics, dfir
Recuperabit
A tool for forensic file system reconstruction.
Stars: ✭ 280 (+418.52%)
Mutual labels:  dfir, forensics
Turbinia
Automation and Scaling of Digital Forensics Tools
Stars: ✭ 461 (+753.7%)
Mutual labels:  dfir, forensics
View All Similar Projects ➔

AutoTimeliner

Autotimeliner

Automagically extract forensic timeline from volatile memory dumps.

Requirements

  • Python 3
  • Volatility
  • mactime (from SleuthKit)

(Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5)

How it works

AutoTimeline automates this workflow:

  • Identify correct volatility profile for the memory image.
  • Runs the timeliner plugin against volatile memory dump using volatility.
  • Runs the mftparser volatility plugin, in order to extract $MFT from memory and generate a bodyfile.
  • Runs the shellbags volatility plugin in order to generate a bodyfile of the user activity. (suggested by Matteo Cantoni).
  • Merges the timeliner, mftparser and shellbags output files into a single bodyfile.
  • Sorts and filters the bodyfile using mactime and exports data as CSV.

Installation

Simply clone the GitHub repository:

git clone https://github.com/andreafortuna/autotimeliner.git

Usage

autotimeline.py [-h] -f IMAGEFILE [-t TIMEFRAME] [-p CUSTOMPROFILE]

optional arguments:
  -h, --help            show this help message and exit
  -f IMAGEFILE, --imagefile IMAGEFILE
                        Memory dump file
  -t TIMEFRAME, --timeframe TIMEFRAME
                        Timeframe used to filter the timeline (YYYY-MM-DD
                        ..YYYY-MM-DD)
  -p CUSTOMPROFILE, --customprofile CUSTOMPROFILE
                        Jump image identification and use a custom memory
                        profile

Examples

Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21

Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21

Extract timeline from TargetServerMemory.raw, using a custom memory profile:

./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64

All timelines will be saved as $ORIGINALFILENAME-timeline.csv.

TODO

  • Better image identification
  • Better error trapping
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].