[sleuthkit-users] Timeline generation when given the mactime file

[Adam M. <mar...@gm...>]

Hello,

I have a question regarding the generation of timeline. I'm using Autopsy
3.1.0_Beta2 on Windows. I have the body file and mactime file generated by
other means and I'd like to use Autopsy just for generating the timeline
when given only those files. I already fooled Autopsy just to parse the
given mactime file by storing the mactime file in the directory of the
corresponding case. Graph was drawn nicely, but information about the files
in Table view were missing. These information are clearly not taken only
from those files, however it would be nice to have such functionality that
takes only mactime file as input and generates the timeline with some
reduced information in Table view. Is it possible to do something like that
in Autopsy? Or is it possible to write some module that would offer such
functionality? Or do you know about any other simple application that
offers such functionality?

Thank you very much,

Adam