Re: [sleuthkit-users] DateTime Info on each line of Timeline

[Michel R. <mi...@ro...>]

Surago Jones wrote:

>Yet another question,
>
>When creating timelines (from within Autopsy), is it possible to have
>the DateTime information inserted on every line of the output, as when
>using Grep to extract information for certain dates from a timeline it
>would (I assume) exclude lines that do not have the date information on
>them.
>  
>
To have DateTime Info on each line of Timeline, I have written the 
following script in awk, and it seems to be working :)

BEGIN {Dname=""
        mm=""
        dd=""
        yy=""
        hh=""}

{ if ($1 ~ /[0-9]+/) {print Dname " " mm " " dd " " yy " " hh " " 
substr($0,26)}
 else { Dname=$1
        mm=$2
        dd=$3
        yy=$4
        hh=$5
        print $0 }
}


-- 
Michel Roukine
Expertise et investigation en informatique
Tel: 33 4 75 56 71 71, Fax: 33 4 75 56 58 61