Digital Forensics and Incident Response | DFIR
  • Blog
  • Infosec
  • Windows Forensics
  • Mac Forensics
  • Memory Forensics
  • Incident Response
  • CISSP

Filesystem based timeline

8/8/2019

0 Comments

 
We are going to use the MFTECmd tool developed by Eric Zimmerman to perform a filesystem based timeline.

G:\>MFTECmd.exe  -f  "<Source>" --body "<Dest>" --bodyf <filename.body> --blf --bdl  <Drive>

Tool Details:
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd

Running this command will save the data in a body file at the specified destination location.

Once you have the body - you can use SANS Sift workstation create a timeline out of the bodyfile

mactime -z UTC -y -d -b /test.body 2019-07-23..2019-08-07 > /test-filesystem-timeline.csv


    
Picture
Picture
You can use another tool called Timeline Explorer to analyze the timeline.
Picture
0 Comments



Leave a Reply.

    Archives

    April 2020
    September 2019
    August 2019
    July 2019
    June 2019
    April 2019
    February 2019
    March 2018

    Categories

    All
    Aws
    Cloud
    Dfir
    Incident Response
    Linux
    Recon

    RSS Feed