Timeline Analysis Part 4 : Timescanner

In our last episode of Timeline Analysis, we covered the magic that is “log2timeline”…thank you Kristinn! The question I left y’all with (remember, I do live in Oklahoma) is, “How great would be if we had a tool that would leverage the log2timeline-y goodness, but not require you to feed it the local system logs”? I told you such a tool existed, and told you it was called, “Timescanner”. In this post, we will cover this tool.

Timescanner is another tool written by Kristinn, and does exactly what we talked about…it searches the target (either live file system, or mounted forensic image) and searches for the types of log files supported by log2timeline. It then parses those files and add them into the body file, which we would ultimately use to generate our timeline. Let’s take a look at how the tool works.

Again, this is a Perl script written natively in Linux. Getting it working on my Windows XP box with Active Perl 5.10.1 was no proverbial walk in the park. It only took me a few hours of updating perl modules (.pm)s and various other dlls. One thing you will absolutely need to install in “WinPCAP”. Before even starting to try to get all of the pms for Timescanner, go grab it and install it. It will save you some headaches in the long run.

Recall from my last post, that whenever you run a Perl script for the first time, it’s a good idea to determine which modules you may need to load. So to do this…you might try something like this…

C:\tools\log2timeline> more timescanner (If you prefer, can you just open the script with any text editor)

This will give you a full text listing of the Perl script, but the section we are really interested in is this…

Now, this is not to say that these are ALL of the .pms you will need, but making sure these are installed properly will minimize the amount of tweaking you will have to do to get the scrip working.

Once you have your .pms loaded, you care ready to kickoff Timescanner.

The syntax is pretty basic and will look like this…

C:\tools\log2timeline> perl timescanner –d C:\

I skipped the –z option for timeZone, since I am in the central time zone, and I don’t need to make any modifications. However, if you are working a case in one timezone, and your evidence is from a different timezone, this will be a useful option. To see which timezones are supported, simply use this command…

C:\tools\log2timeline> perl log2timeline –z list

OK…so really…all you have to do it run this command…

C:\tools\log2timeline> perl timescanner –d C:\ > bodyfile4

..and timescanner will do the rest! Then, you simply use mactime again to generate the timeline and you will have added to your timeline, all supported log file types from the target drive/image!

Here is a snippet of my timeline…

Here you can clearly see my actions for the day! From what news I was reading from the BBC to creating the file I am using to write this blog entry…all right there!

So, what’s even cooler is that I now have a file that is also fully searchable!

Let’s say I wanted to see the activity from May 11^th, or May 10^th? Or what about hits for certain keywords like “pinball” or “DEFCON”? Well, just use grep and you can find them right away! Like so…

Now, the screenshot I provided above from MS Excel has been slightly modified to enable you to see the full paths of what Timescanner will report on. I simply highlighted the fields I did not want to see, right clicked on them, and selected “hide”. To get them back, just right click and select “unhide”.

So now, all you would have to do to create a Super Timeline is to simply use the same bodyfile as your output for each of the tools, then use that bodyfile as the input for mactime. It should be noted that this entire process, from the first time you run FLS, to the final compilation of the timeline with mactime, should take less than an hour. So as an investigator, what is that worth to you in terms of how quickly you can generate a full timeline of your suspect system and how much data is actually available to you? My answer is, “a whole freaking lot”!

If you are one of those investigators who are constantly on the search for a “silver bullet”, then I am sorry to disappoint you, but this is not it. There is not “Forensicator Pro” (hehe….thanks for the good joke though Ovie/Brett), there is no “Find All Evidence” button, and “X” never ever marks the spot. What this WILL do for you is give you a clear snapshot of the status of the system at any given, and stored, point in time. It is a tool for generating data points by which you can build your theory of the incident based on the available evidence. Tools should never replace sound logic, forensic methodology, and due diligence.

In addition to my instructions provided on my blog, these tools (and many others) are precompiled and freely available in the SIFT Workstation v2.0. It is a FREE VM image that can be downloaded from the SANS website that I’m certain you will find very very useful. A word of warning though, this image is Linux based, so if you are not comfortable using the command line…well…you need to get that way. May of the more powerful tools out there do not have GUIs, and for good reason. There is no joy or glory is being a “push button Monkey”…and frankly, you can be a very thorough investigator if all you know how to do is click on buttons predefined by somebody else. No offence to anyone, but if you truly want to get better at being a forensic investigator, you really need to become comfortable with the command line.

Hmmmm….sounds like another idea for a blog series?!?!?!