Aggregates timestamps from disk images, memory dumps, logs, PCAPs, and reports into a unified forensic timeline.
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill timeline-fuzzdkk
Please help me install this Agent Skill. Skill: timeline Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/timeline Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill timeline-fuzzdkk
Build a single, coherent timeline by combining timestamps from disks, memory, logs, PCAPs, and reports to reveal the sequence of events.
Provide a path to the evidence directory to generate the unified timeline.
High-intent search queries and answers about installing and using this skill.
To build a unified forensic timeline, aggregate timestamps from disk images, memory dumps, logs, and PCAPs into a single sequential view. This process normalizes diverse formats and time zones to reveal the exact sequence of investigation events.
Timestamp normalization handles MACB timestamps by standardizing diverse time zones and source-specific formats into a single consistent structure. This preserves the correct chronological order of forensic events across all aggregated evidence.
Yes, you can reconstruct network activity and memory artifacts in the same DFIR timeline. The merging logic coordinates timestamp extraction from PCAPs and memory dumps alongside disk metadata to produce a unified chronological narrative.
The best way to consolidate disk image and log timestamps is to aggregate them into a normalized timeline. This produces a coherent narrative of events suitable directly for stakeholder briefings and investigation reporting.
Supported evidence formats for sequential event reconstruction include disk images, memory dumps, logs, PCAPs, and reports. The aggregation logic handles source-specific artifacts from each to merge timestamps accurately.
jd-opensourceIdentify and extract artifacts from memory dumps, PCAPs, and disk images.
YukiIto1999Analyzes Windows event logs, PCAPs, and filesystem artifacts to detect security incidents.
xjtu-wangCorrelate EVTX, Sysmon, registry, memory, and PCAP artifacts into a defendable attacker timeline.
takusaotomeAnalyzes log files to identify root causes of errors and crashes.
