www.williballenthin.com/forensics/mft/indxparse/
INDXParse is a suite of tools forensic investigators can use to inspect NTFS artifacts. Although INDXParse was once a single tool for working with directory index entries, the project now includes many more capabilities. These includes file enumeration, m ...
maresware.com/maresware/df.htm
Is a simple program used to convert the long value of a date (ie 912345678) to a traditional month day year, date format.
maresware.com/maresware/gk.htm
Kiting will take a fixed length record and analyze two fields containing dates. It calculates the difference of two date fields and then appends to the record a 5 digit number representing the difference in days between the two dates.
www.crypsisgroup.com/tool-item/timefrag/
TimeFrag empowers analysts to process and timeline large amounts of data. TimeFrag ingests data from multiple sources, captures time related information, and presents users with an easy to use interface to perform timeline analysis. Register to download y ...
www.beedocs.com/timeline3D/mac/
"Present historical events with Timeline 3D to reveal connections and clarify relationships. Make timeline charts of world history, family trees, fictional stories or business deadlines. Timelines help you understand and present history with new perspecti ...
computerforensics.parsonage.co.uk/timelord/timelord.htm
Paul Tew has released his TimeLord utility, it is the most comprehensive time utility software available for Windows OS. It can be used to - Display the Time Zone on the host computer together with all details of the time zone and DST settings. Displ ...
© 2018 Copyright | DFIR Training