tag:blogger.com,1999:blog-7683355055095156894.post9150442123858627537..comments2023-08-26T03:16:28.562-05:00Comments on The Digital Standard: Timeline Analysis Part I : Creating a Timeline of a Live Windows Systemcepoguehttp://www.blogger.com/profile/15373293682953028712noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-7683355055095156894.post-46236796052072159102011-03-21T14:40:35.800-05:002011-03-21T14:40:35.800-05:00PART 2
http://thedigitalstandard.blogspot.com/201...PART 2<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-2-registry.html<br /><br />PART 3<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-3-log2timeline.html<br /><br />PART 4<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-4-timescanner.htmlExcellentPosthttp://exepost.me.comnoreply@blogger.comtag:blogger.com,1999:blog-7683355055095156894.post-71116102431595866712011-03-21T14:32:02.911-05:002011-03-21T14:32:02.911-05:00PART 2
http://thedigitalstandard.blogspot.com/201...PART 2<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-2-registry.html<br /><br />PART 3<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-3-log2timeline.html<br /><br />PART 4<br /><br />http://thedigitalstandard.blogspot.com/2010/03/timeline-analysis-part-4-timescanner.htmlAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-7683355055095156894.post-89527105771150025272010-03-17T19:58:43.903-05:002010-03-17T19:58:43.903-05:00Good question Grayson. You can do both...TSK can ...Good question Grayson. You can do both...TSK can be run against either am image or a live system...in this case, the advantage of running the tools against a live system is speed. You get the answers you are looking for now, which has some pretty clear advantages when dealing with a skittish customer.cepoguehttps://www.blogger.com/profile/15373293682953028712noreply@blogger.comtag:blogger.com,1999:blog-7683355055095156894.post-23194059972680771152010-03-17T15:22:22.712-05:002010-03-17T15:22:22.712-05:00Great write up. Why the focus on a live machine? I...Great write up. Why the focus on a live machine? Is it just that it hasn't really been explained before on a step by step basis? Is there a specific reason when you would or would not want to do this live instead of from a traditional static image?Grayson Lenikhttps://www.blogger.com/profile/15457122858920457681noreply@blogger.com