Timeline analysis: from mactime to the super timeline
You merge file system times with mactime and hundreds of artefact sources with plaso into one timeline, then filter millions of rows down to the minutes that matter.
Level 301 · 16 lessons · 15 practice labs
Lessons
Time basics
- MACB times: modified, accessed, changed and born
- Clock skew, time zones and daylight-saving traps
- File system, event and super timelines compared
- Short task: work out a system’s clock offset from the evidence
File system timeline
- Producing a body file with fls
- A readable timeline with mactime
- Starting from a known event: the anchor point
- Short task: what changed in the 10 minutes before the anchor
The super timeline with plaso
- Collecting events from an image with log2timeline
- plaso parsers and targeted collection
- Filtering with psort and exporting to CSV
- Browsing and colour-coding the timeline in a table view
- Short task: find when persistence was set up in the super timeline
Concluding
- Pivoting on time: jumping from one artefact to the next
- Turning a timeline into an incident narrative
- Capstone: rebuild, minute by minute, the two days before a ransomware attack
Practice labs
- Read MACB times: Interpret the modified, accessed, changed and born times of five files.
- Calculate the system's clock offset: Determine the system's clock drift and time zone by comparison with a known outside event.
- Solve the daylight saving trap: Find the one-hour ambiguity in records falling on a daylight saving change and establish the right order.
- Produce a body file with fls: Produce a body file from an image with fls and report the line count.
- A readable timeline with mactime: Turn the body file into a timeline with mactime and filter the incident day.
- Ten minutes before the anchor point: Go back from a known file creation moment and explain everything that changed in the ten minutes before.
- Collect events with log2timeline: Produce a plaso storage file from a small image and show the number of events collected.
- Choose targeted parsers: Collect with only shell history, syslog and browser parsers and measure the time difference.
- Find the moment persistence was set: Find the moment the persistence entry appeared in the super timeline and the action just before it.
- Export to CSV with psort: Convert the storage file to CSV with psort and explain the columns.
- Filter by time range and source: Extract only file and log events around the incident hour with a psort filter.
- Colour and browse in a table view: Open the timeline in a table tool, colour execution, persistence and network events and mark three turning points.
- Pivot from one trace to another: Start from a downloaded file's time and pivot to browser and process events in the same minute.
- Turn the timeline into an incident narrative: Turn a twenty-line selected timeline into a five-paragraph narrative.
- Reconstruct the two days before encryption: In Kuzeyyıldızı Kargo's prepared image, reconstruct the two days before the files were encrypted minute by minute from first access.
About this course
You merge file system times with mactime and hundreds of artefact sources with plaso into one timeline, then filter millions of rows down to the minutes that matter.
What you will learn
- Time basics
- File system timeline
- The super timeline with plaso
- Concluding
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.