sleuthkit-users

[sleuthkit-users] DateTime Info on each line of Timeline

[Surago J. <su...@sj...>]

Yet another question,

When creating timelines (from within Autopsy), is it possible to have
the DateTime information inserted on every line of the output, as when
using Grep to extract information for certain dates from a timeline it
would (I assume) exclude lines that do not have the date information on
them.

Cheers

Surago

Re: [sleuthkit-users] DateTime Info on each line of Timeline

[Michel R. <mi...@ro...>]

Surago Jones wrote:

>Yet another question,
>
>When creating timelines (from within Autopsy), is it possible to have
>the DateTime information inserted on every line of the output, as when
>using Grep to extract information for certain dates from a timeline it
>would (I assume) exclude lines that do not have the date information on
>them.
>  
>
To have DateTime Info on each line of Timeline, I have written the 
following script in awk, and it seems to be working :)

BEGIN {Dname=""
        mm=""
        dd=""
        yy=""
        hh=""}

{ if ($1 ~ /[0-9]+/) {print Dname " " mm " " dd " " yy " " hh " " 
substr($0,26)}
 else { Dname=$1
        mm=$2
        dd=$3
        yy=$4
        hh=$5
        print $0 }
}


-- 
Michel Roukine
Expertise et investigation en informatique
Tel: 33 4 75 56 71 71, Fax: 33 4 75 56 58 61

Re: [sleuthkit-users] DateTime Info on each line of Timeline

[Brian C. <ca...@sl...>]

On Feb 8, 2005, at 4:52 AM, Surago Jones wrote:

> Yet another question,
>
> When creating timelines (from within Autopsy), is it possible to have
> the DateTime information inserted on every line of the output, as when
> using Grep to extract information for certain dates from a timeline it
> would (I assume) exclude lines that do not have the date information on
> them.

If you use the '-d' flag, you get a comma delimited format that is 
better for sorting and excluding data.  it has a time value for each 
line.

brian