Timesketch
Collaborative forensic timeline analysis
...The system supports tagging, sketch notes, and story building so teams can annotate findings and share context without losing the raw data trail. Integrations with popular DFIR pipelines make ingestion repeatable, while role-based access and audit logs support enterprise workflows. By combining scale, collaboration, and reproducibility, Timesketch moves incident response beyond ad-hoc spreadsheets to a durable, team-oriented investigation record.