Zeitline is a Java/Swing tool that allows a computer forensicinvestigator to import events from various sources of a computingsystem or network and then order and classify them into one or moretimelines of events.
Be the first to post a text review of Zeitline. Rate and review a project by clicking thumbs up or thumbs down in the right column.
This releases introduces a few new user feddback features, a change in the event class hierarchy and more detailed display information, as well as a few bug fixes. Please see README and CHANGELOG for details.
Fixed in version 0.2: - File dialogs now start with the current working directory on all tested platforms (Linux, OSX, and Windows XP). They also remember their latest chosen directories. - Fixed a bug saving/loading project files if not in current working directory. New in version 0.2: - AtomicEvents now have to be sub-classed. This allows a events to be specific regarding their source/purpose, resulting in smaller storage requirement (no need to store information as strings anymore) and also lets the tool display specific fields unique to the sub-class, which is beneficial to the investigator. The GenericEvent class functions like the old AtomicEvent class. We also provide new MACTimeEvent and SyslogEvent classes. Sub-classed events can have their own icons, display panels, and we are working on event-specific query dialogs for a future version. - Improved GUI feedback. The progess bar and some alerts have received some updates to point out status and error messages more clearly. - Parameters required for the import filters can now be queried and preset directly in the import dialog. Before, the filter would pop up a separate dialog to query any parameters. The SyslogFilter is an example of a filter that requires a parameter (start year). - We now ask the user if he wants to save his changes (yes/no/cancel) when the ComplexEvent data has changed and the user tries to change to a different event. - For future use, "reported time" and "adjusted time" fields have been added to AtomicEvents. Fixed in version 0.1b: - Eliminated variable file names called 'enum'. The code will now compile under Java version 1.5. Compile warnings remain under Java version 1.5 due to our use of the java.util.Vector class in a fashion that is compatible with Java version 1.4. - Added some null pointer checks in the drag and drop code. This should have only been an issue under Java version 1.5 or Mac OSX. - Fixed bug that accidentally deleted events. This would happen when creating a new complex event from all the child event of another complex event. The empty parent event would be deleted before we attempt to insert the newly created one. Thanks to Nigel Tingle for reporting this bug. - Fixed a bug that created a null pointer exception when inserting an event into an empty ComplexEvent that is not the root node of a timeline (EventTree). - Fixed a bug that would let Zeitline not access its filters in the JAR file when executing the JAR from a directory not containing the JAR. Thanks to Jan Iven for reporting this bug. - Fixed a bug that would let Zeitline crash when not executing it from a directory that contains a 'filters' directory. Thanks to Jan Iven for reporting this bug. - Changed filename 'ICONS' to 'ICONLICENSE' because on some operating systems this would conflict with the 'icons' directory. New in version 0.1b: - Added a check box in the AtomicEvent display mask that lets a user decide whether or not to delete a ComplexEvent when it is empty. The default is to delete the event. New in version 0.1: - Added "search" functionality. It is now possible to search and locate specific events that match a Query. The next (or previous) matching event is displayed and highlighted, so is the timeline that contains the event. Searches can "wrap around" if desired. - New import filter classes can be added to Zeitline even without having to recompile the whole software. It is sufficient to create a class that extends the abstract InputFilter class and copy that class to the "filters" directory. Zeitline will recognize those classes at startup and make them available during import. - Added a Linux syslog filter. - Changed the InputFilter.init() method declaration to include a Component parameter. This allows filters to pop up windows to query data. - Added a progress bar for the import process. It is now possible to cancel an import while it displays the progress bar. - Makefile can now generate releases. New in version 0.alpha: - Fixed null pointer exception when choosing 'Clear selection' menu item when no timelines are in the project yet. - Fixed error in the 'paste' functionality when performing a cut and then pasting the data back to the same parent event. - Fixed key accelerators for menu and toolbar actions. NOTE: key bindings might be subject to change in the future. - Removed icons from menus.
Fixed in version 0.2: - File dialogs now start with the current working directory on all tested platforms (Linux, OSX, and Windows XP). They also remember their latest chosen directories. - Fixed a bug saving/loading project files if not in current working directory. New in version 0.2: - AtomicEvents now have to be sub-classed. This allows a events to be specific regarding their source/purpose, resulting in smaller storage requirement (no need to store information as strings anymore) and also lets the tool display specific fields unique to the sub-class, which is beneficial to the investigator. The GenericEvent class functions like the old AtomicEvent class. We also provide new MACTimeEvent and SyslogEvent classes. Sub-classed events can have their own icons, display panels, and we are working on event-specific query dialogs for a future version. - Improved GUI feedback. The progess bar and some alerts have received some updates to point out status and error messages more clearly. - Parameters required for the import filters can now be queried and preset directly in the import dialog. Before, the filter would pop up a separate dialog to query any parameters. The SyslogFilter is an example of a filter that requires a parameter (start year). - We now ask the user if he wants to save his changes (yes/no/cancel) when the ComplexEvent data has changed and the user tries to change to a different event. - For future use, "reported time" and "adjusted time" fields have been added to AtomicEvents. Fixed in version 0.1b: - Eliminated variable file names called 'enum'. The code will now compile under Java version 1.5. Compile warnings remain under Java version 1.5 due to our use of the java.util.Vector class in a fashion that is compatible with Java version 1.4. - Added some null pointer checks in the drag and drop code. This should have only been an issue under Java version 1.5 or Mac OSX. - Fixed bug that accidentally deleted events. This would happen when creating a new complex event from all the child event of another complex event. The empty parent event would be deleted before we attempt to insert the newly created one. Thanks to Nigel Tingle for reporting this bug. - Fixed a bug that created a null pointer exception when inserting an event into an empty ComplexEvent that is not the root node of a timeline (EventTree). - Fixed a bug that would let Zeitline not access its filters in the JAR file when executing the JAR from a directory not containing the JAR. Thanks to Jan Iven for reporting this bug. - Fixed a bug that would let Zeitline crash when not executing it from a directory that contains a 'filters' directory. Thanks to Jan Iven for reporting this bug. - Changed filename 'ICONS' to 'ICONLICENSE' because on some operating systems this would conflict with the 'icons' directory. New in version 0.1b: - Added a check box in the AtomicEvent display mask that lets a user decide whether or not to delete a ComplexEvent when it is empty. The default is to delete the event. New in version 0.1: - Added "search" functionality. It is now possible to search and locate specific events that match a Query. The next (or previous) matching event is displayed and highlighted, so is the timeline that contains the event. Searches can "wrap around" if desired. - New import filter classes can be added to Zeitline even without having to recompile the whole software. It is sufficient to create a class that extends the abstract InputFilter class and copy that class to the "filters" directory. Zeitline will recognize those classes at startup and make them available during import. - Added a Linux syslog filter. - Changed the InputFilter.init() method declaration to include a Component parameter. This allows filters to pop up windows to query data. - Added a progress bar for the import process. It is now possible to cancel an import while it displays the progress bar. - Makefile can now generate releases. New in version 0.alpha: - Fixed null pointer exception when choosing 'Clear selection' menu item when no timelines are in the project yet. - Fixed error in the 'paste' functionality when performing a cut and then pasting the data back to the same parent event. - Fixed key accelerators for menu and toolbar actions. NOTE: key bindings might be subject to change in the future. - Removed icons from menus.
Fixed in version 0.2: - File dialogs now start with the current working directory on all tested platforms (Linux, OSX, and Windows XP). They also remember their latest chosen directories. - Fixed a bug saving/loading project files if not in current working directory. New in version 0.2: - AtomicEvents now have to be sub-classed. This allows a events to be specific regarding their source/purpose, resulting in smaller storage requirement (no need to store information as strings anymore) and also lets the tool display specific fields unique to the sub-class, which is beneficial to the investigator. The GenericEvent class functions like the old AtomicEvent class. We also provide new MACTimeEvent and SyslogEvent classes. Sub-classed events can have their own icons, display panels, and we are working on event-specific query dialogs for a future version. - Improved GUI feedback. The progess bar and some alerts have received some updates to point out status and error messages more clearly. - Parameters required for the import filters can now be queried and preset directly in the import dialog. Before, the filter would pop up a separate dialog to query any parameters. The SyslogFilter is an example of a filter that requires a parameter (start year). - We now ask the user if he wants to save his changes (yes/no/cancel) when the ComplexEvent data has changed and the user tries to change to a different event. - For future use, "reported time" and "adjusted time" fields have been added to AtomicEvents. Fixed in version 0.1b: - Eliminated variable file names called 'enum'. The code will now compile under Java version 1.5. Compile warnings remain under Java version 1.5 due to our use of the java.util.Vector class in a fashion that is compatible with Java version 1.4. - Added some null pointer checks in the drag and drop code. This should have only been an issue under Java version 1.5 or Mac OSX. - Fixed bug that accidentally deleted events. This would happen when creating a new complex event from all the child event of another complex event. The empty parent event would be deleted before we attempt to insert the newly created one. Thanks to Nigel Tingle for reporting this bug. - Fixed a bug that created a null pointer exception when inserting an event into an empty ComplexEvent that is not the root node of a timeline (EventTree). - Fixed a bug that would let Zeitline not access its filters in the JAR file when executing the JAR from a directory not containing the JAR. Thanks to Jan Iven for reporting this bug. - Fixed a bug that would let Zeitline crash when not executing it from a directory that contains a 'filters' directory. Thanks to Jan Iven for reporting this bug. - Changed filename 'ICONS' to 'ICONLICENSE' because on some operating systems this would conflict with the 'icons' directory. New in version 0.1b: - Added a check box in the AtomicEvent display mask that lets a user decide whether or not to delete a ComplexEvent when it is empty. The default is to delete the event. New in version 0.1: - Added "search" functionality. It is now possible to search and locate specific events that match a Query. The next (or previous) matching event is displayed and highlighted, so is the timeline that contains the event. Searches can "wrap around" if desired. - New import filter classes can be added to Zeitline even without having to recompile the whole software. It is sufficient to create a class that extends the abstract InputFilter class and copy that class to the "filters" directory. Zeitline will recognize those classes at startup and make them available during import. - Added a Linux syslog filter. - Changed the InputFilter.init() method declaration to include a Component parameter. This allows filters to pop up windows to query data. - Added a progress bar for the import process. It is now possible to cancel an import while it displays the progress bar. - Makefile can now generate releases. New in version 0.alpha: - Fixed null pointer exception when choosing 'Clear selection' menu item when no timelines are in the project yet. - Fixed error in the 'paste' functionality when performing a cut and then pasting the data back to the same parent event. - Fixed key accelerators for menu and toolbar actions. NOTE: key bindings might be subject to change in the future. - Removed icons from menus.
Be the first person to add a text review.
Copyright © 2009 Geeknet, Inc. All rights reserved. Terms of Use
Thanks for your rating!
Would you also like to write a review?